Vulnerability · Published Dec 26, 2023 · Assigned by WPScan
CVE-2023-5203WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection
High 7.5
In plain English
A high-severity security flaw in WP Sessions Time Monitoring Full Automatic from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.2%top 17.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Sessions Time Monitoring Full Automatic | 0 – before 1.0.9 |
References
- https://wpscan.com/vulnerability/7f4f505b-2667-4e0f-9841-9c1cd0831932 exploit, vdb-entry, technical-description