by Kastro
Paper/Archive/CVE-2023-0224

CVE-2023-0224

Unknown GiveWP — GiveWP < 2.24.1 - Unauthenticated SQLi

EPSS 4%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 89.9.899 × 2018.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks

Affected

ProductAffectedFixed inSource
GiveWP< 2.24.12.24.1CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitwpscan.com/vulnerability/d8da539d-0a1b-46ef-b48d-710c59cf68e1refgivewp.com/core-2-24-0-vulnerability-patched