CVE-2019-25746
HIGHWordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25746. PoCs published by Lucian Ioan Nitescu.
AI-analyzed exploit summary This exploit demonstrates an authenticated SQL injection vulnerability in WordPress Sliced Invoices plugin versions below 3.8.2. The PoC uses a time-based SQL injection via the 'post' parameter to confirm exploitation.
Description
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.
Exploits (1)
This exploit demonstrates an authenticated SQL injection vulnerability in WordPress Sliced Invoices plugin versions below 3.8.2. The PoC uses a time-based SQL injection via the 'post' parameter to confirm exploitation.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N