The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/45194442-6eea-4e07-85a5-4a1e2fde3523 | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/45194442-6eea-4e07-85a5-4a1e2fde3523 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 08:40
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/45194442-6eea-4e07-85a5-4a1e2fde3523 - Exploit, Third Party Advisory |
24 Jan 2024, 19:20
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 | |
| CPE | cpe:2.3:a:tracktheclick:track_the_click:*:*:*:*:*:wordpress:*:* | |
| References | () https://wpscan.com/vulnerability/45194442-6eea-4e07-85a5-4a1e2fde3523 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
17 Jan 2024, 17:35
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-17 15:15
Updated : 2024-11-21 08:40
NVD link : CVE-2023-5041
Mitre link : CVE-2023-5041
CVE.ORG link : CVE-2023-5041
JSON object : View
Products Affected
tracktheclick
- track_the_click
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')