SupportCandy – Helpdesk & Customer Support Ticket System, CVE-2023-2805
- CVE, Research URL
- Home page URL
-
Security reports for SupportCandy – Helpdesk & Customer Support Ticket System
- Published on
- Jun 19, 2023
- Research Description
- The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Affected versions
-
max 3.1.7.
- Status
-
vulnerable