CVE-2020-5579 - SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors

Back Back to CVE browser

HIGH

SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors

Published May 20, 2020

7.2

HIGH

CVSS 3.1

EPSS 1.19%

Description

SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.

Affected products

Vendor Stranger Studios Product Paid Memberships Default
n/a
- Version
  versions prior to 2.3.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Stranger Studios

Paid Memberships

n/a

Version	Status	Constraints
versions prior to 2.3.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26741
Advisory
https://jvn.jp/en/jp/JVN20248858/index.html
x_refsource_MISCThird Party Advisory
https://www.paidmembershipspro.com/pmpro-update-2-3-3-security-release/
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26741		Advisory
https://jvn.jp/en/jp/JVN20248858/index.html		x_refsource_MISCThird Party Advisory
https://www.paidmembershipspro.com/pmpro-update-2-3-3-security-release/		x_refsource_MISCVendor Advisory