CVE-2022-1685
Five Minute Webshop <= 1.3.2 - Admin+ SQLi via orderby
MEDIUM 4.9EPSS 1.0%
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
- Affected
- Five Minute Webshop
- CVSS v3.1 NVD
- 4.9 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - CVSS v2.0 NVD
- 4.0 MEDIUM
AV:N/AC:L/Au:S/C:N/I:P/A:N - EPSS
- 0.99% chance of exploitation in the next 30 days, 62nd percentile
- Published
- 2022-06-06
- Updated
- 2024-08-03
Proof-of-concept exploits (2)
- https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1
- https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97