CVE-2023-5041

Track The Click < 0.3.12 - Author+ Time-Based Blind SQL Injection

High · published January 17, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
65.4
In the wild
Unconfirmed
What it is

The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01100 · 65.4th percentile
Published
2024-01-17T14:27Z
EPSS history
Timeline
  • 17 JAN 14:27Z
    Track The Click < 0.3.12 - Author+ Time-Based Blind SQL Injection
    cvelistv5