PT-2023-8402 · WordPress · Wordpress Database Administrator

Christiaan Swiers · Published 2023-07-24 · Updated 2024-01-22 · CVE-2023-3211

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WordPress Database Administrator plugin versions 1.0.3 and earlier

Description The issue is related to a SQL injection problem. It occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement via an AJAX action. This AJAX action is available to unauthenticated users, making it accessible to remote attackers. The exploitation of this issue can allow an attacker to execute arbitrary SQL queries.

Recommendations For WordPress Database Administrator plugin versions 1.0.3 and earlier, as a temporary workaround, consider disabling the AJAX action related to the SQL query until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-00649

CVE-2023-3211

Affected Products

Wordpress Database Administrator

References · 6

• 🔥 https://wpscan.com/vulnerability/873824f0-e8b1-45bd-8579-bc3c649a54e5 · Exploit
• https://bdu.fstec.ru/vul/2024-00649 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3211 · Security Note
• https://twitter.com/CVEnew/status/1747293159242231859 · Twitter Post
• https://vuldb.com/es/?id.235398 · Note