PT-2023-18350 · WordPress · Colibri Page Builder

Marco Wotschka · CVE-2023-2188 · Publicado 2023-08-31 · Atualizado 2023-09-05

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Colibri Page Builder for WordPress versions up to, and including, 1.0.227

Description The issue allows authenticated attackers with administrator-level privileges to perform SQL Injection via the post id parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This enables attackers to append additional SQL queries into already existing queries, potentially extracting sensitive information from the database.

Recommendations For versions up to, and including, 1.0.227, consider restricting access to the post id parameter until a patch is available. As a temporary workaround, limit the privileges of administrators to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-2188

Produtos afetados

Colibri Page Builder

Referências · 6

• https://wordfence.com/threat-intel/vulnerabilities/id/c73d4b78-72aa-409a-a787-898179773b82?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/utils.php#L556 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-2188 · Nota de Segurança
• https://t.me/cibsecurity/69531 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-2188 · Aviso do Fabricante
• https://plugins.trac.wordpress.org/changeset/2922722 · Correção