WordPress Plugin Vulnerabilities

Game Server Status <= 1.0 - Contributor+ SQL Injection

Description

The plugin does not validate or escape the server id shortcode attribute before using it in a SQL statement, allowing any user with a role as low as contributor to perform SQL Injection attacks

Proof of Concept

Affects Plugins

Plugin icon
game-server-status
No known fix

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
7.7 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
84f99864-7720-49b7-a9f1-e4b0c17e5c80

Timeline

Publicly Published
2021-09-21 (about 4 years ago)
Added
2021-09-21 (about 4 years ago)
Last Updated
2021-09-21 (about 4 years ago)

Other

Published
Title
Published
2025-07-11
Title
WordPress-WPJobBoard < 25.09000000-WP6.8.2-JB5.12.0 - Unauthenticated SQLi
Published
2011-04-26
Title
SermonBrowser <= 0.43.5 - SQL Injection
Published
2024-10-18
Title
Photo Gallery Slideshow & Masonry Tiled Gallery < 1.0.4 - Authenticated (Admin+) SQL Injection
Published
2019-07-26
Title
Photo Gallery by 10Web <= 1.5.30 - SQL Injection
Published
2025-01-03
Title
Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection