CVE-2023-6030

MEDIUMNuclei

LogDash Activity Log < 1.1.4 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-6030 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it doesn't escape the username when it perform some SQL request leading to a SQL injection vulnerability which can be exploited using time-based technique by unauthenticated attacker

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 16, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

LogDash Activity Log

Default status: unaffected

CVE ListBefore 1.1.4affected

Nuclei templates

1
ProjectDiscoveryCRITICALLogDash Activity Log <= 1.1.3 - SQL InjectionCVSS 9.8

The LogDash Activity Log plugin for WordPress is vulnerable to SQL Injection via the username parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Impact

Unauthenticated attackers can exploit SQL injection to execute arbitrary SQL commands, potentially compromising the database.

Remediation

Upgrade to version 1.1.4 or later.

WeaknessesCWE-89
AuthorsShivam Kamboj
Template tagscvecve2023wordpresswpwp-pluginsqlilogdash-activity-log
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/logdash-activity-log/logdash-activity-log-113-unauthenticated-sql-injection https://nvd.nist.gov/vuln/detail/CVE-2023-6030

Source: ProjectDiscovery

References

2