Time-Based SQL Injection Vulnerability in Google Tag Manager for WooCommerce Plugin
CVE-2024-0786
6.5MEDIUM
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 28 February 2024
What is CVE-2024-0786?
The Conversios plugin for Google Analytics 4, Meta Pixel, and WooCommerce is susceptible to a time-based SQL Injection vulnerability through the 'ee_syncProductCategory' function. This issue arises from inadequate escaping of user-provided parameters such as 'conditionData', 'valueData', 'productArray', 'exclude', and 'include'. Authenticated attackers with subscriber-level access or higher can exploit this vulnerability by injecting additional SQL queries into existing queries, potentially leading to the extraction of sensitive database information.
Affected Version(s)
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce * <= 6.9.1