CVE-2016-20072

Name of the Vulnerable Software and Affected Versions BBS e-Franchise versions prior to 1.1.4

Description An SQL injection issue exists due to insufficient escaping of user-supplied input and lack of proper preparation of SQL queries. Unauthenticated attackers can execute arbitrary SQL queries by injecting malicious code through the uid parameter in pages using the plugin shortcode. This allows the use of UNION-based SQL injection to extract sensitive data from the database, such as user information and taxonomy terms.

Recommendations Update to a version newer than 1.1.3. As a temporary workaround, restrict access to the uid parameter until the update is applied.