PT-2021-16074
CVE-2021-24554
·
تاريخ النشر
2021-08-23
·
تاريخ التحديث
2021-08-26
الوصف من
CVSS 3.1
7.2
عاليةالمقاييسAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Paytm – Donation Plugin WordPress plugin versions 1.3.2 and earlier
Description
The issue arises from the plugin's failure to sanitise, validate, or escape the
id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue.Recommendations
For Paytm – Donation Plugin WordPress plugin versions 1.3.2 and earlier, update to a version that addresses this issue.
As a temporary workaround, consider restricting access to the donation deletion functionality to minimize the risk of exploitation.
Avoid using the
id GET parameter in the affected API endpoint until the issue is resolved.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾