Unauthenticated SQL Injection Vulnerability in Piraeus Bank WooCommerce Payment Gateway Plugin

CVE-2024-0610

What is CVE-2024-0610?

The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is subject to a time-based blind SQL injection vulnerability. This issue arises from inadequate escaping of user-supplied parameters, particularly the 'MerchantReference' parameter. Versions of the plugin up to and including 1.6.5.1 lack sufficient preparation for the SQL queries, allowing unauthenticated attackers to inject additional SQL statements. Consequently, this could lead to the unauthorized extraction of sensitive data from the database, posing significant risks to data integrity and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References