The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/a282606f-6abf-4f75-99c9-dab0bea8cc96 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: WPScan
Published: 2022-04-25T15:50:44
Updated: 2022-06-20T10:25:39
Reserved: 2021-01-14T00:00:00
Link: CVE-2021-24957
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-04-25T16:16:07.057
Modified: 2022-12-02T22:41:39.457
Link: CVE-2021-24957
JSON object: View
Redhat Information
No data.
CWE