CVE-2023-1408

HIGHNuclei

Video List Manager <= 1.7 - Admin+ SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-1408 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 29, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Video List Manager

Default status: affected

CVE ListThrough 1.7affected

Nuclei templates

1
ProjectDiscoveryHIGHVideo List Manager <= 1.7 - SQL InjectionCVSS 7.2

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

Impact

Authenticated high-privilege attackers (admin) can exploit SQL injection through the videoID parameter to extract database contents, potentially stealing user credentials, video metadata, and compromising the WordPress database.

Remediation

Update Video List Manager plugin to a version newer than 1.7 that uses parameterized queries or prepared statements for the videoID parameter in admin.php.

WeaknessesCWE-89
Authorsr3Y3r53
Template tagstime-based-sqlicvecve2023wpscansqliwordpresswp-pluginwpauthenticatedvideo_list_manager_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:video_list_manager_project:video_list_manager:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/video-list-manager/
FOFA: body=/wp-content/plugins/video-list-manager/
https://wpscan.com/vulnerability/baf7ef4d-b2ba-48e0-9c17-74fa27e0c15b https://wordpress.org/plugins/video-list-manager/ https://nvd.nist.gov/vuln/detail/CVE-2023-1408

Source: ProjectDiscovery

References

2