A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
| Link | Tags |
|---|---|
| https://wordpress.org/plugins/advanced-cf7-db/#developers | third party advisory |
| https://wpvulndb.com/vulnerabilities/9479 | vdb entry third party advisory |
| https://fortiguard.com/zeroday/FG-VD-19-093 | broken link |
| https://plugins.trac.wordpress.org/changeset/2123623 | third party advisory release notes |
| https://github.com/beerpwn/ctf/blob/master/CVE/CVE-2019-13571/report.pdf | technical description exploit |
| https://github.com/beerpwn/ctf/tree/master/CVE/CVE-2019-13571 | technical description exploit |