Description

WordPress Plugin Quote-O-Matic is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin Quote-O-Matic version 1.0.5 is vulnerable; prior versions may also be affected.

Remediation

Disable and remove the plugin until a fix is available

References

https://sploitus.com/exploit?id=WPEX-ID:AA07DDAC-4F3D-4C4C-BA26-19BC05F22F02

https://wordpress.org/plugins/quote-o-matic/#description

Related Vulnerabilities

WordPress Plugin HTML5 AV Manager for WordPress 'custom.php' Arbitrary File Upload (0.2.7)

Oracle JRE CVE-2012-1725 Vulnerability (CVE-2012-1725)

ownCloud Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-9041)

WordPress Plugin Contest Gallery-Photo Contest for WordPress Cross-Site Scripting (13.1.0.9)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2014-2270)

Severity

High

Classification

CVE-2022-4373 CWE-89 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection