IVPAY paymentsに認証不要のSQLi脆弱性、修正版なし
Summary
WordPressの決済プラグインIVPAY paymentsに、ログイン不要でデータベースの中身を読み取られる脆弱性が見つかりました。修正版が確認できないため、使っているサイトは無効化を先に検討してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WordPressの決済プラグインIVPAY paymentsに、ログイン不要でデータベースの中身を読み取られる脆弱性が見つかりました。修正版が確認できないため、使っているサイトは無効化を先に検討してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| CVE の記録IVPAY payments |
1.0.0 – 1.0.8→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web contact@wpscan.com
- web nvd.nist.gov
- web wpscan.com
- web github.com