Description (CNA)
The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST['order'][0]['dir'] parameter is not properly escaped leading to blind and error-based SQL injections.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / SEO Booster | affected 3.8 before 3.8 |
CWE
CWE-89
References
- https://wpscan.com/vulnerability/40849d93-8949-4bd0-b60e-c0330b385fea
- https://plugins.trac.wordpress.org/changeset/2637115
ADP enrichment
No English description supplied.