CVE-2018-25352
HIGHWordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry_id
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2018-25352. PoCs published by defensecode.
AI-analyzed exploit summary This is a technical writeup detailing a SQL injection vulnerability in the WordPress Ultimate Form Builder Lite plugin. It identifies the vulnerable function ($wpdb->get_row()), the vulnerable variable ($_POST['entry_id']), and the attack vector via a crafted POST request to admin-ajax.php.
Description
WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the entry_id POST parameter. Attackers can send POST requests to the admin-ajax.php endpoint with the ufbl_get_entry_detail_action action to extract, modify, or escalate privileges within the WordPress database.
Exploits (1)
This is a technical writeup detailing a SQL injection vulnerability in the WordPress Ultimate Form Builder Lite plugin. It identifies the vulnerable function ($wpdb->get_row()), the vulnerable variable ($_POST['entry_id']), and the attack vector via a crafted POST request to admin-ajax.php.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N