PT-2023-8402 · WordPress · Wordpress Database Administrator

Christiaan Swiers · Publicado 2023-07-24 · Atualizado 2024-01-22 · CVE-2023-3211

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WordPress Database Administrator plugin versions 1.0.3 and earlier

Description The issue is related to a SQL injection problem. It occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement via an AJAX action. This AJAX action is available to unauthenticated users, making it accessible to remote attackers. The exploitation of this issue can allow an attacker to execute arbitrary SQL queries.

Recommendations For WordPress Database Administrator plugin versions 1.0.3 and earlier, as a temporary workaround, consider disabling the AJAX action related to the SQL query until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2024-00649

CVE-2023-3211

Produtos afetados

Wordpress Database Administrator

Referências · 6

• 🔥 https://wpscan.com/vulnerability/873824f0-e8b1-45bd-8579-bc3c649a54e5 · Exploit
• https://bdu.fstec.ru/vul/2024-00649 · Nota de Segurança
• https://twitter.com/CVEnew/status/1747293159242231859 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-3211 · Aviso do Fabricante
• https://vuldb.com/es/?id.235398 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-3211 · Nota de Segurança