CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service.
Explanation of Vulnerability in Simple Terms
The Adivaha Travel Plugin for WordPress contains a SQL injection vulnerability in version 2.3 and earlier. An attacker can inject malicious SQL commands through unfiltered input, potentially reading or modifying the site's database. No authentication is required to exploit this vulnerability.
What an attacker can do
Read or modify the WordPress database, including user credentials and sensitive site data.
Potential impact on your site
Attackers can steal user data, modify posts, inject malware, or take over admin accounts.
Conditions required to exploit
Network access to the site; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
