PT-2021-15930
CVE-2021-24397
·
تاريخ النشر
2021-09-20
·
تاريخ التحديث
2021-09-29
الوصف من
CVSS 3.1
7.2
عاليةالمقاييسAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
MicroCopy WordPress plugin versions 1.1.0 and earlier
Description
The issue arises from the edit functionality in the MicroCopy WordPress plugin, which makes a GET request to fetch a related option. The
id parameter used in this process is not sanitized, escaped, or validated before being inserted into a SQL statement, leading to SQL injection.Recommendations
For MicroCopy WordPress plugin versions 1.1.0 and earlier, update to a version later than 1.1.0 to resolve the issue.
As a temporary workaround, consider restricting access to the edit functionality until a patch is available.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾