PT-2023-16012 · WordPress · Simple Urls

Dc11 · Published 2023-02-13 · Updated 2023-02-21 · CVE-2023-0098

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simple URLs WordPress plugin versions prior to 115

Description The issue concerns a SQL injection problem. It arises because the plugin does not properly escape certain parameters before using them in SQL statements for AJAX actions. These actions are accessible to any authenticated user, making the SQL injection exploitable by low-privilege users, such as subscribers.

Recommendations For versions prior to 115, update to version 115 or later to resolve the SQL injection issue. As a temporary workaround, consider restricting access to AJAX actions to higher-privileged users until the update can be applied.

Exploit

Fix

Related Identifiers

CVE-2023-0098

Affected Products

Simple Urls

References · 4

• 🔥 https://wpscan.com/vulnerability/db0b3275-40df-404e-aa8d-53558f0122d8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-0098 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0098 · Vendor Advisory
• https://t.me/cvenotify/44229 · Telegram Post