Blind SQL Injection Vulnerability in tagDiv Opt-In Builder Plugin
CVE-2023-3419

7.2HIGH

Key Information:

Vendor

Tagdiv

Status
Tagdiv Opt-in Builder
Vendor
CVE Published:
17 August 2024

What is CVE-2023-3419?

The tagDiv Opt-In Builder plugin is susceptible to a Blind SQL Injection vulnerability via the 'couponId' parameter of the 'recreate_stripe_subscription' REST API endpoint in versions up to and including 1.4.4. This vulnerability arises from inadequate user input escaping and insufficient preparation of the SQL query. Authenticated attackers with administrator privileges can exploit this weakness to inject additional SQL queries into existing queries, potentially exposing sensitive information from the underlying database. Maintaining secure coding practices and ensuring thorough input validation are crucial to mitigate such vulnerabilities.

Affected Version(s)

tagDiv Opt-In Builder * <= 1.4.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://tagdiv.com/tagdiv-opt-in-builder/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Truoc Phan
.