WordPress Waiting: One-click countdowns Plugin <= 0.6.2 is vulnerable to SQL Injection

Software Waiting: One-click countdowns Type Plugin Vulnerable versions = 0.6.2 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-28659 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID bd389c037bcc Credits Joshua Martinelle Tenable Research...

CVE-2023-28659

The Waiting: One-click Countdowns WordPress Plugin, version = 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbcdownmetaid parameter of the pbcsavedowns action...

CVE-2023-28659

The Waiting: One-click Countdowns WordPress Plugin, version = 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbcdownmetaid parameter of the pbcsavedowns action...

Waiting: One-click Countdowns <= 0.6.2 - Subscriber+ SQLi

The plugin does not properly sanitise and escape the pbcdownmetaid parameter before using it in a SQL statement via the pbcsavedowns AJAX action, leading to a SQL injection exploitable by any authenticated users, such as subscriber PoC Run the below command in the developer console of the web...

CVE-2023-28659: Improper Neutralization of Special Elements used in an SQL Command

The Waiting: One-click Countdowns WordPress Plugin, version = 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbcdownmetaid parameter of the pbcsavedowns action...

CVE-2021-25064

Consolidated details for CVE-2021-25064 show: affected product is the WordPress Wow Countdowns plugin up to version 3.1.2. The root cause is improper sanitization of the did parameter, which is directly used in a SQL statement, resulting in an authenticated SQL Injection. Exploitation evidence ap...

WordPress plugin Wow Countdowns SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Wow Countdowns plugin version 3.1.2 later has a SQL injection vulnerability, which stems from the plugin using the user The...

Wow Countdowns <= 3.1.2 - Admin+ SQLi

The plugin does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection. https://example.com/wp-admin/admin.php?page=mwp-countdown&info=del&did=1+AND+SELECT+5382+FROM+SELECTSLEEP5PpNt...

Wow Countdowns <= 3.1.2 - Admin+ SQLi

The plugin does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection. PoC https://example.com/wp-admin/admin.php?page=mwp-countdown=del=1+AND+SELECT+5382+FROM+SELECTSLEEP5PpNt...