Lucene search
HistoryOct 16, 2023 - 8:15 p.m.
CVE-2023-4776
sql injection
wordpress plugin
low-privilege users
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
24.2%
The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
Affected configurations
Node
igexsolutionswpschoolpressRange<2.2.5wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| igexsolutions | wpschoolpress | * | cpe:2.3:a:igexsolutions:wpschoolpress:*:*:*:*:*:wordpress:*:* |
Related
wpexploit
wpexploit
WPSchoolPress < 2.2.5 - Teacher+ SQLi
2023-09-25 00:00:00
wpvulndb
wpvulndb
WPSchoolPress < 2.2.5 - Teacher+ SQLi
2023-09-25 00:00:00
cvelist
cvelist
CVE-2023-4776 WPSchoolPress < 2.2.5 - Teacher+ SQLi
2023-10-16 19:38:59
prion
prion
Sql injection
2023-10-16 20:15:00
cve
cve
CVE-2023-4776
2023-10-16 20:15:16
wordfence
wordfence
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
24.2%
Related for NVD:CVE-2023-4776