SQL Injection in Swit Wp Sessions Time Monitoring Full Automatic
CVE-2023-5203
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.022 (81.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 81.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.022 · newest: 0.022 · change: 0.000
Affected products
- Swit Wp Sessions Time Monitoring Full Automatic
- Wp Sessions Time Monitoring Full Automatic — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- wpscan.com/vulnerability/7f4f505b-2667-4e0f-9841-9c1cd0831932 (Exploit, technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2023-5203?
- CVE-2023-5203 is a high-severity vulnerability in Swit Wp Sessions Time Monitoring Full Automatic, classified under SQL Injection. CVSS score: 7.5/10. Published 2023-12-26.
- How severe is CVE-2023-5203?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-5203 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.