Ultimate Product Catalog, 1e3e9939-9948-4184-98cf-7a76b5ee7da9
- CVE, Research URL
- Home page URL
- Application
- Published on
- -
- Research Description
- Ultimate Product Catalog [ultimate-product-catalogue] < 3.1.3 Ultimate Product Catalogue <= 3.1.2 - Unauthenticated SQL Injection Unauthenticated SQL injection in ajax call when the plugin is counting the times a product is being seen by the web visitors. The vulnerable POST parameter is "Item_ID". Vulnerable code: In file Functions/Process_Ajax.php line 67: [...] $Item_ID = $_POST['Item_ID']; $Item = $wpdb->get_row("SELECT Item_Views FROM $items_table_name WHERE Item_ID=". $Item_ID); [...]
- Affected versions
-
max 3.1.3.
- Status
-
vulnerable