CVE-2022-1453
RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection
概要
RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory wordfence.com
- patch github.com
- web plugins.trac.wordpress.org
- web wordfence.com