PT-2023-16820 · WordPress · Http Headers

Qerogram · Publicado 2023-05-15 · Atualizado 2025-01-24 · CVE-2023-1207

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HTTP Headers WordPress plugin versions prior to 1.18.8

Description The issue concerns an import functionality in the HTTP Headers WordPress plugin that executes arbitrary SQL on the server, leading to an SQL Injection vulnerability. This allows for potential exploitation by executing unauthorized SQL commands.

Recommendations For versions prior to 1.18.8, update to version 1.18.8 or later to resolve the issue. As a temporary workaround, consider disabling the import functionality until a patch is available. Restrict access to the import feature to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2023-1207

Produtos afetados

Http Headers

Referências · 5

• 🔥 https://wpscan.com/vulnerability/6f3f460b-542a-4d32-8feb-afa1aef57e37 · Exploit
• https://t.me/cibsecurity/64135 · Publicação no Telegram
• https://t.me/cvenotify/108545 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-1207 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-1207 · Aviso do Fabricante