CVE-2023-5203

WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection

The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.

Affected

WP Sessions Time Monitoring Full Automatic

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

2.20% chance of exploitation in the next 30 days, 82nd percentile

Nuclei

critical · CWE-89

Published

2023-12-26

Updated

2024-09-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/7f4f505b-2667-4e0f-9841-9c1cd0831932

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5203.yaml

References

• CVE Record
• NVD entry