The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/546c47c2-5b4b-46db-b754-c6b43aef2660 | Exploit Third Party Advisory |
Configurations
History
25 Sep 2024, 14:33
Type | Values Removed | Values Added |
---|---|---|
First Time |
Strategy11 awp Classifieds
Strategy11 |
|
CPE | cpe:2.3:a:strategy11:awp_classifieds:*:*:*:*:*:wordpress:*:* |
Information
Published : 2022-10-31 16:15
Updated : 2024-09-25 14:33
NVD link : CVE-2022-3254
Mitre link : CVE-2022-3254
CVE.ORG link : CVE-2022-3254
JSON object : View
Products Affected
strategy11
- awp_classifieds
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')