Sql injection

🗓️ 31 Aug 2023 06:15:00Reported by PRIOn knowledge baseType

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows subscribers or higher to append additional SQL queries to extract sensitive information from the database

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2023-3677	31 Aug 202312:12	–	circl
CNNVD	WordPress plugin WooCommerce PDF Invoice Builder SQL注入漏洞	31 Aug 202300:00	–	cnnvd
CVE	CVE-2023-3677	31 Aug 202305:33	–	cve
Cvelist	CVE-2023-3677 WooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Export	31 Aug 202305:33	–	cvelist
EUVD	EUVD-2023-44316	3 Oct 202520:07	–	euvd
NVD	CVE-2023-3677	31 Aug 202306:15	–	nvd
OSV	CVE-2023-3677	31 Aug 202306:15	–	osv
Patchstack	WordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.89 is vulnerable to SQL Injection	14 Aug 202300:00	–	patchstack
Positive Technologies	PT-2023-25693 · WordPress · Woocommerce Pdf Invoice Builder	31 Aug 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-3677	23 May 202502:30	–	redhatcve

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/woo-pdf-invoice-builder/trunk/woocommerce-pdf-invoice-ajax.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/4336d597-7e87-46eb-8abd-9fafd6cd25d9
plugins	www.plugins.trac.wordpress.org/changeset/2949518/woo-pdf-invoice-builder/trunk/woocommerce-pdf-invoice-ajax.php

01 Sep 2023 13:04Current

8.7High risk

Vulners AI Score8.7

EPSS0.00619