CVE-2023-6030 — LogDash Activity Log < 1.1.4 - Unauthenticated SQLi

CVE-2023-6030

LogDash Activity Log < 1.1.4 - Unauthenticated SQLi PUBLISHED

Description (CNA)

The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it doesn't escape the username when it perform some SQL request leading to a SQL injection vulnerability which can be exploited using time-based technique by unauthenticated attacker

Affected (CNA)

Vendor / product	Versions
Unknown / LogDash Activity Log	affected 0 before 1.1.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b658e403-006c-4555-b1b2-3603e44f4411/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.