VDB
CVE-2018-3811
CVE-2018-3811
PUBLISHED
KEV
CVSS 9.800000190734863 CRITICAL
SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in the context of the web server. The saveGoogleAdWords() function in smartgooglecode.php did not use prepared statements and did not sanitize the $_POST["oId"] variable before passing it as input into the SQL query.
EPSS 42.01% · 98.6th percentile
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
42.01%
98.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| oturia | smart_google_code_inserter | 0 |
Timeline
- CVE Published
- Jan 3, 2018 PoC Published
- Jan 3, 2018 PoC Published
- Apr 14, 2021 EPSS Score
- Aug 2, 2021 PoC Published
- Aug 25, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- May 3, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Nov 8, 2022 EPSS Score
- Mar 13, 2023 EPSS Score
References
- https://wordpress.org/plugins/smart-google-code-inserter/#developers url
- https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.html url
- https://nvd.nist.gov/vuln/detail/CVE-2018-3811 advisory
- https://www.exploit-db.com/exploits/43420 url
- https://wpvulndb.com/vulnerabilities/8988 advisory
- https://www.exploit-db.com/exploits/43420/ exploit