CVE-2020-37243: WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and 'Edit HTML' fields that execute malicious scripts when viewing pricing tables.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37243?
CVE-2020-37243 has a high severity rating due to the potential for unauthorized SQL injection attacks.
How do I fix CVE-2020-37243?
To fix CVE-2020-37243, update to a patched version of the Supsystic Pricing Table plugin that resolves the SQL injection vulnerability.
What type of attack can be executed through CVE-2020-37243?
CVE-2020-37243 allows attackers to execute arbitrary SQL queries, potentially accessing sensitive database information.
Is CVE-2020-37243 exploitable without authentication?
Yes, CVE-2020-37243 is exploitable by unauthenticated attackers leveraging the 'sidx' GET parameter.
What versions of the Supsystic Pricing Table are affected by CVE-2020-37243?
CVE-2020-37243 specifically affects version 1.8.7 of the Supsystic Pricing Table plugin.