Lucene search
Sanjay DasWPEX-ID:9F03BC1A-214F-451A-89FD-2CD3517E8F8AHistorySep 20, 2022 - 12:00 a.m.
Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi
2022-09-2000:00:00
Sanjay Das
73
wordpress
security
sql injection
polylang plugin
csv
xml
txt
vulnerability
exploit
EPSS
0.001
Percentile
32.2%
The plugin does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin
With the additional https://wordpress.org/plugins/polylang/ plugin installed, import a CSV with the following payload in the language_code column: en' union select if(user_login='wordpress',sleep(5),null) from wp_users#Related
wpvulndb
wpvulndb
Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi
2022-09-20 00:00:00
prion
prion
Sql injection
2022-10-17 12:15:00
nvd
nvd
CVE-2022-3243
2022-10-17 12:15:10
patchstack
patchstack
cve
cve
CVE-2022-3243
2022-10-17 12:15:10
cvelist
cvelist
CVE-2022-3243 Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi
2022-10-17 00:00:00