CVE-2022-23911 - AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection

Back Back to CVE browser

HIGH

AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection

Published Feb 28, 2022

7.2

HIGH

CVSS 3.1

EPSS 1.47%

Description

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection

Affected products

Vendor n/a Product Testimonial WordPress Plugin – AP Custom Testimonial Default
n/a
- Version
  1.4.6
  Status
  affected
  Constraints
  <1.4.6*
- Version
  1.4.7
  Status
  affected
  Constraints
  <1.4.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Testimonial WordPress Plugin – AP Custom Testimonial

n/a

Version	Status	Constraints
1.4.6	affected	<1.4.6*
1.4.7	affected	<1.4.7

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28833
Advisory
https://plugins.trac.wordpress.org/changeset/2664185
x_refsource_CONFIRMRelease NotesThird Party Advisory
https://wpscan.com/vulnerability/77fd6749-4fb2-48fa-a191-437b442f28e9
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28833		Advisory
https://plugins.trac.wordpress.org/changeset/2664185		x_refsource_CONFIRMRelease NotesThird Party Advisory
https://wpscan.com/vulnerability/77fd6749-4fb2-48fa-a191-437b442f28e9		x_refsource_MISCExploitThird Party Advisory