CVE-2023-1471

Published on: Not Yet Published

Last Modified on: 03/17/2023 03:44:00 PM UTC

CVE-2023-1471

Certain versions of WP Popup Banners from Access-keys contain the following vulnerability:

The WP Popup Banners plugin for WordPress is vulnerable to SQL Injection via the 'banner_id' parameter in versions up to, and including, 1.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with minimal permissions, such as a subscrber, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2023-1471 has been assigned by [email protected] to track the vulnerability
Affected Vendor/Software: access-keys - WP Popup Banners version <= 1.2.5

CVE References

Description	Tags ^ⓘ	Link
WP Popup Banners <= 1.2.5 - Authenticated (Subscriber+) SQL Injection	www.wordfence.com text/html	MISC www.wordfence.com/threat-intel/vulnerabilities/id/8281cb20-73d3-4ab5-910e-d353b2a5cbd8?source=cve
403 Forbidden	plugins.trac.wordpress.org text/html Inactive LinkNot Archived	MISC plugins.trac.wordpress.org/browser/wp-popup-banners/trunk/wp-popup-banners.php#L246
403 Forbidden	plugins.trac.wordpress.org text/html Inactive LinkNot Archived	MISC plugins.trac.wordpress.org/browser/wp-popup-banners/trunk/wp-popup-banners.php#L243

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

There are currently no QIDs associated with this CVE

Known Affected Software

Vendor	Product	Version
Access-keys	WP_Popup_Banners	<= 1.2.5

No vendor comments have been submitted for this CVE

Social Mentions

Source	Title	Posted (UTC)
@CVEreport	CVE-2023-1471 : The WP Popup Banners plugin for WordPress is vulnerable to SQL Injection via the 'banner_id' parame… twitter.com/i/web/status/1…	2023-03-17 14:06:09
/r/netcve	CVE-2023-1471	2023-03-17 15:38:13