PT-2021-17125
CVE-2021-26754
·
تاريخ النشر
2021-02-07
·
تاريخ التحديث
2021-02-09
الوصف من
CVSS 2.0
10
حرجةالمقاييسAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
wpDataTables versions prior to 3.4.1
Description
The issue is related to how wpDataTables handles order direction for server-side tables, leading to a SQL injection. This can be exploited through the "admin-ajax.php?action=get wdtable" endpoint, specifically by manipulating the
order[0][dir] parameter.Recommendations
For versions prior to 3.4.1, update to version 3.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "admin-ajax.php?action=get wdtable" endpoint or avoiding the use of the
order[0][dir] parameter in this endpoint until the update is applied.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾