CVE-2022-1692
Assigner: WPScan
Published: 2022-06-06T08:51:29
State: PUBLISHED
affected: product: CP Image Store with Slideshow
vendor: Unknown
versions: lessThan: 1.0.68
status: affected
version: 1.0.68
versionType: custom
credits: value: Daniel Krohmer (Fraunhofer IESE)
value: Shi Chen (University of Kaiserslautern)
descriptions: value: The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 SQL Injection
type: CWE
source: discovery: EXTERNAL
title: CP Image Store with Slideshow < 1.0.68 - Unauthenticated SQLi
x_generator: WPScan CVE Generator