Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin for WordPress.This issue affects CM Popup Plugin for WordPress: from n/a through 1.5.10.
La neutralización incorrecta de elementos especiales utilizados en una vulnerabilidad de comando SQL ("Inyección SQL") en CreativeMindsSolutions CM Popup Plugin for WordPress. Este problema afecta a CM Popup Plugin for WordPress: desde n/a hasta 1.5.10.
The CM Pop-Up banners plugin for WordPress is vulnerable to generic SQL Injection via the getStatistics function in versions up to, and including, 1.5.10 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers , with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The plugin patched the issue by commenting out the function calls to functions that contained vulnerable SQL queries.
