Time-Based SQL Injection Vulnerability in Slideshow Gallery LITE Plugin

CVE-2024-5543

Summary

The Slideshow Gallery LITE plugin for WordPress has a vulnerability that allows for time-based SQL injection via the 'id' parameter. This flaw affects all versions up to and including 1.8.1, stemming from inadequate escaping of user-supplied data and insufficient preparation of the SQL query. Authenticated users with Contributor-level access or higher can exploit this vulnerability to inject additional SQL commands into existing queries, potentially leading to unauthorized access to sensitive information stored in the database.

References