PT-2021-15745
CVE-2021-24200
·
تاريخ النشر
2021-04-12
·
تاريخ التحديث
2021-04-13
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions:
wpDataTables – Tables & Table Charts premium WordPress plugin versions prior to 3.4.2
Description:
The issue allows a low-privilege authenticated user to perform Boolean-based blind SQL Injection on the "/wp-admin/admin-ajax.php?action=get wdtable&table id=1" endpoint, specifically through the
length HTTP POST parameter. This enables an attacker to access all database data and obtain access to the WordPress application.Recommendations:
For wpDataTables – Tables & Table Charts premium WordPress plugin versions prior to 3.4.2, update to version 3.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/wp-admin/admin-ajax.php?action=get wdtable&table id=1" endpoint to minimize the risk of exploitation. Avoid using the
length parameter in the affected endpoint until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾