CVE-2023-3435

CWE-89 — SQL Injection3 documents3 sources
Severity
9.8CRITICAL
EPSS
0.6%
top 29.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown User Activity LOGSolwininfotech User Activity LOG
Timeline
PublishedAug 14

Description

The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5unknown/user_activity_log< 1.6.5

🔴Vulnerability Details

2
GHSA
GHSA-83g3-fg3c-hpxj: The User Activity Log WordPress plugin before 1↗2023-08-14
▶
CVEList
User Activity Log < 1.6.5 - Unauthenticated SQLi↗2023-08-14
▶
CVE-2023-3435 (CRITICAL CVSS 9.8) | The User Activity Log WordPress plu | cvebase.io