WordPress Plugin Vulnerabilities
Membership by Supsystic <= 1.5.0 - Authenticated SQL Injection
Description
The GET parameter "sidx" and "search are used in a SQL statement without being sanitised when searching for badges in the dashboard, leading to authenticated SQL Injection issues. v1.4.8 attempted a fix, which was found to not be sufficient
Proof of Concept
The PoC will be displayed once the issue has been remediated
Affects Plugins
No known fix - plugin closed
References
ExploitDB
Classification
Miscellaneous
Timeline
Publicly Published
2021-02-08 (about 2 years ago)
Added
2021-02-08 (about 2 years ago)
Last Updated
2021-02-09 (about 2 years ago)