PT-2023-16114 · WordPress · Simple Membership Wp User Import

Etan Imanol Castro Aldrete · Publicado 2023-01-12 · Atualizado 2023-01-20 · CVE-2023-0254

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simple Membership WP user Import plugin for WordPress versions up to, and including, 1.7

Description The issue allows for SQL Injection via the orderby parameter due to insufficient escaping on the user-supplied parameter. This enables authenticated attackers with administrative privileges to append additional SQL queries into existing queries, potentially extracting sensitive information from the database.

Recommendations For versions up to, and including, 1.7, consider disabling the orderby parameter until a patch is available to prevent SQL Injection attacks. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the orderby parameter in the affected plugin until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-0254

Produtos afetados

Simple Membership Wp User Import

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-0254 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0254 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/6f781533-b633-4452-95bd-c32ed0de2ea9 · Correção
• https://wordfence.com/threat-intel/vulnerabilities/id/6f781533-b633-4452-95bd-c32ed0de2ea9?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2829005%40simple-membership-wp-user-import&new=2829005%40simple-membership-wp-user-import&sfp_email=&sfph_mail= · Correção
• https://t.me/cibsecurity/56439 · Publicação no Telegram