HazelPress Lite - exploit.company

vendor:

HazelPress Lite

by:

cr4wl3r

9,8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: HazelPress Lite

Affected Version From: 0.0.4

Affected Version To: 0.0.4

Patch Exists: YES

Related CWE: CVE-2020-14092

CPE: a:hazelpress:hazelpress_lite

Metasploit: N/A

Other Scripts: N/A

Tags: wp-plugin,sqli,paypal,wpscan,cve,cve2020,wordpress

CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nuclei References: https://wpscan.com/vulnerability/10287, https://wordpress.dwbooster.com/forms/payment-form-for-paypal-pro, https://nvd.nist.gov/vuln/detail/CVE-2020-14092, https://wordpress.org/plugins/payment-form-for-paypal-pro/#developers, https://wpvulndb.com/vulnerabilities/10287

Nuclei Metadata: {'max-request': 1, 'framework': 'wordpress', 'vendor': 'ithemes', 'product': 'paypal_pro'}

Platforms Tested: None

2020

HazelPress Lite <= 0.0.4 (Auth Bypass) SQL Injection Vulnerability

WordPress PayPal Pro plugin before 1.1.65 is susceptible to SQL injection via the 'query' parameter which allows for any unauthenticated user to perform SQL queries with the results output to a web page in JSON format.

Mitigation:

Upgrade to the latest version of HazelPress Lite.

Source

HazelPress Lite <= 0.0.4 (Auth Bypass) SQL Injection Vulnerability

Mitigation:

Exploit-DB raw data: