CVE-2023-3435
User Activity Log < 1.6.5 - Unauthenticated SQLi
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
The User Activity Log plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.6.4 via the ual_export_log() and ual_export_user_log() function that is missing preparation on existing queries as well as escaping on the user input passed to them. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This issue was partially patched in 1.6.4, which made it only exploitable by authenticated users, a full patch was released in 1.6.5.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2023-06-27 CVE Reserved
- 2023-07-24 CVE Published
- 2024-10-09 CVE Updated
- 2024-10-09 First Exploit
- 2024-12-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-862: Missing Authorization
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://wpscan.com/vulnerability/30a37a61-0d16-46f7-b9d8-721d983afc6b | 2024-10-09 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Solwininfotech Search vendor "Solwininfotech" | User Activity Log Search vendor "Solwininfotech" for product "User Activity Log" | < 1.6.5 Search vendor "Solwininfotech" for product "User Activity Log" and version " < 1.6.5" | wordpress |
Affected
| ||||||