SQL Injection Vulnerability in Thumbnail Carousel Slider Plugin for WordPress
CVE-2019-25222
4.9MEDIUM
What is CVE-2019-25222?
The Thumbnail Carousel Slider Plugin for WordPress is susceptible to SQL injection attacks through the 'id' parameter. This vulnerability arises from inadequate escaping of user-supplied input and a lack of proper SQL query preparation in versions up to and including 1.0.4. Attackers, who do not require authentication, can exploit this flaw to execute malicious SQL commands, potentially accessing sensitive information stored in the database.
Affected Version(s)
Thumbnail carousel slider * <= 1.0.4
References
CVSS V3.1
Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Ala Arfaoui