Unrated

Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection

CVE-2022-0411 First seen on SecPulse Feb 28, 2022

Original description The description as published by the source.

The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory github.com
advisory nvd.nist.gov
web plugins.trac.wordpress.org
web wpscan.com

Key facts

Severity: Unrated
Published: Feb 28, 2022
First seen on SecPulse: Feb 28, 2022
CWE: CWE-89

NVD OSV

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 20, 19:55