CVE-2023-2608: CSRF
First published: Wed May 17 2023(Updated: )
The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the projects_list function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries leading to resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Version 3.3.18 addresses the SQL Injection, which drastically reduced the severity.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Themeisle Multiple Page Generator | <3.3.18 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/controllers/ProjectsListManage.php#L40
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2910686%40multiple-pages-generator-by-porthas%2Ftrunk&old=2905353%40multiple-pages-generator-by-porthas%2Ftrunk&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912909%40multiple-pages-generator-by-porthas&new=2912909%40multiple-pages-generator-by-porthas&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d900584c-0f58-4abc-92ff-841f898d02fc?source=cve
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-2608.
What is the severity of CVE-2023-2608?
The severity of CVE-2023-2608 is medium.
How does CVE-2023-2608 affect the Multiple Page Generator Plugin for WordPress?
CVE-2023-2608 affects the Multiple Page Generator Plugin for WordPress by making it vulnerable to Cross-Site Request Forgery and time-based SQL Injection.
What is the affected version of the Multiple Page Generator Plugin for WordPress?
The affected version of the Multiple Page Generator Plugin for WordPress is up to and including version 3.3.17.
How can CVE-2023-2608 be exploited?
CVE-2023-2608 can be exploited by manipulating the orderby and order parameters in the projects_list function.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- agent/description
- agent/first-publish-date
- agent/tags
- vendor/themeisle
- canonical/themeisle multiple page generator