Vulnerability · Published Jan 17, 2024 · Assigned by WPScan
CVE-2023-5041Track The Click < 0.3.12 - Author+ Time-Based Blind SQL Injection
High 8.8
In plain English
A high-severity security flaw in Track The Click from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.1%top 34.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Track The Click | 0 – before 0.3.12 |
References
- https://wpscan.com/vulnerability/45194442-6eea-4e07-85a5-4a1e2fde3523 exploit, vdb-entry, technical-description