Unauthenticated SQL Injection Vulnerability in Piraeus Bank WooCommerce Payment Gateway Plugin

CVE-2024-0610

What is CVE-2024-0610?

The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is subject to a time-based blind SQL injection vulnerability. This issue arises from inadequate escaping of user-supplied parameters, particularly the 'MerchantReference' parameter. Versions of the plugin up to and including 1.6.5.1 lack sufficient preparation for the SQL queries, allowing unauthenticated attackers to inject additional SQL statements. Consequently, this could lead to the unauthorized extraction of sensitive data from the database, posing significant risks to data integrity and security.

References