9.8

CVE-2022-3241

Exploit

Build App Online < 1.0.19 - Unauthenticated SQL Injection

Build App Online <= 1.0.18 - Unauthenticated SQL Injection

The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Mögliche Gegenmaßnahme
Build App Online: Update to version 1.0.19, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rahamsolutions ≫ Build App Online SwPlatformwordpress Version < 1.0.19
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Build App Online
Version *-1.0.18
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.04% 0.594
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/a995dd67-43fc-4087-a7f1-5db57f4c828c
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/f15f85c6-0bba-4bbd-b097-d205b9e0a075
Third Party Advisory