GSEOR <= 1.3 - Authenticated SQL Injection

A pageid GET parameter of the plugin is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. PoC GET /wp-admin/admin.php?page=gseor.php=1=1%20AND%20SELECT%206449%20FROM%20SELECTSLEEP5wwdQ HTTP/1.1 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1...

WordPress GSEOR plugin <= 1.3 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Syed Sheeraz Ali in WordPress GSEOR plugin versions = 1.3. Solution This plugin has been closed as of May 13, 2021 and is not available for download. Reason: Security Issue...