Blind Time-Based SQL Injection Vulnerability Affects Blogger Plugin

CVE-2024-10645

Summary

The Blogger 301 Redirect plugin for WordPress is subject to a vulnerability that allows blind time-based SQL injection through improper handling of the ‘br’ parameter. This vulnerability exists in all versions up to and including 2.5.3 due to insufficient escaping of user-supplied parameters and lack of adequate preparation in the SQL queries. An attacker, without needing authentication, can potentially manipulate the SQL queries, paving the way for unauthorized access to sensitive database information. Website administrators are urged to apply the appropriate updates to mitigate this risk.

References