Published: 19/09/2022 Updated: 03/12/2022

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

The Zephyr Project Manager WordPress plugin prior to 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections

Vulnerable Product	Search on Vulmon	Subscribe to Product
zephyr project manager project zephyr project manager

# Exploit Title: Wordpress Plugin Zephyr Project Manager 3242 - Multiple SQLi # Date: 14-08-2022 # Exploit Author: Rizacan Tufan # Blog Post: rizaxblog/blog/wordpress-plugin-zephyr-project-manager-multiple-sqli-authenticated # Software Link: wordpressorg/plugins/zephyr-project-manager/ # Vendor Homepage: zephyr-onecom/ ...

WordPress Zephyr Project Manager plugin version 3242 suffers from a remote SQL injection vulnerability ...

CWE-89 https://wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53c http://packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-Injection.html https://nvd.nist.gov https://www.exploit-db.com/exploits/51024

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2022-2840

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect