MStore API < 3.9.8 - Unauthenticated Blind SQLi

2023-06-1900:00:00

Truoc Phan

mstore api

unauthenticated

blind sqli

exploit

0.059 Low

EPSS

Percentile

93.5%

JSON

The plugin does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins’ pro features, and uses the woocommerce-appointments plugin.

https://vulnerable-site.tld/wp-json/api/flutter_booking/get_staffs?product_id=%27+or+ID=sleep(10)--+-

0.059 Low

EPSS

Percentile

93.5%

JSON

Related for WPEX-ID:9480D0B5-97DA-467D-98F6-71A32599A432