PT-2023-16012 · WordPress · Simple Urls

Dc11 · CVE-2023-0098 · Publicado 2023-02-13 · Atualizado 2023-02-21

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simple URLs WordPress plugin versions prior to 115

Description The issue concerns a SQL injection problem. It arises because the plugin does not properly escape certain parameters before using them in SQL statements for AJAX actions. These actions are accessible to any authenticated user, making the SQL injection exploitable by low-privilege users, such as subscribers.

Recommendations For versions prior to 115, update to version 115 or later to resolve the SQL injection issue. As a temporary workaround, consider restricting access to AJAX actions to higher-privileged users until the update can be applied.

Exploit

Correção

Identificadores relacionados

CVE-2023-0098

Produtos afetados

Simple Urls

Referências · 4

• 🔥 https://wpscan.com/vulnerability/db0b3275-40df-404e-aa8d-53558f0122d8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-0098 · Nota de Segurança
• https://t.me/cvenotify/44229 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-0098 · Aviso do Fabricante