First published: Mon Feb 28 2022(Updated: )
The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection
Credit: contact@wpscan.com
Affected Software | Affected Version | How to fix |
---|---|---|
Asgaros Asgaros Forum | <2.0.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this Asgaros Forum WordPress plugin vulnerability is CVE-2022-0411.
The severity of the CVE-2022-0411 vulnerability is high with a severity value of 8.8.
The CVE-2022-0411 vulnerability affects the Asgaros Forum WordPress plugin by allowing SQL injection through the post_id parameter.
The Asgaros Forum WordPress plugin version before 2.0.0 is affected by the CVE-2022-0411 vulnerability.
Yes, you can find more information about the CVE-2022-0411 vulnerability at the following references: 1. [WordPress Plugins Trac](https://plugins.trac.wordpress.org/changeset/2669226/asgaros-forum). 2. [WPScan](https://wpscan.com/vulnerability/35272197-c973-48ad-8405-538bfbafa172)