CVE-2023-2761

CWE-89 — SQL Injection3 documents3 sources
Severity
7.2HIGH
EPSS
0.2%
top 58.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown User Activity LOGSolwininfotech User Activity LOG
Timeline
PublishedJul 24

Description

The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5unknown/user_activity_log< 1.6.3

🔴Vulnerability Details

2
CVEList
User Activity Log < 1.6.3 - Admin+ SQL Injection↗2023-07-24
▶
GHSA
GHSA-xwrq-g8w9-vh68: The User Activity Log WordPress plugin before 1↗2023-07-24
▶
CVE-2023-2761 (HIGH CVSS 7.2) | The User Activity Log WordPress plu | cvebase.io