SQL Injection in Wpsupportplus Wp Support Plus Responsive Ticket System
CVE-2018-1000131
Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter. This attack appear to be exploitable via web site, without login. This vulnerability appears to have been fixed in 9.0.3 and later.
Vulnerability class: SQL Injection
EPSS: 0.021 (79.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Wpsupportplus Wp_support_plus_responsive_ticket_system
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory, Release Notes)
Frequently asked questions
- What is CVE-2018-1000131?
- CVE-2018-1000131 is a critical-severity vulnerability in Wpsupportplus Wp Support Plus Responsive Ticket System, classified under SQL Injection. CVSS score: 9.8/10. Published 2018-03-14.
- How severe is CVE-2018-1000131?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2018-1000131 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.