vendor:
Simple Ads Manager
by:
Kacper Szurek
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Simple Ads Manager
Affected Version From: 2.9.2004
Affected Version To: 2.9.4.116
Patch Exists: NO
Related CWE:
CPE: a:simple_ads_manager_project:simple_ads_manager:2.9.4
Platforms Tested: WordPress
2015
Simple Ads Manager 2.9.4.116 SQL Injection
$whereClause and $whereClauseT and $whereClauseW and $whereClause2W variables are not properly escaped in the ad.class.php file of Simple Ads Manager plugin.
Mitigation:
The vendor should properly sanitize and escape the input variables to prevent SQL injection attacks. Users should update to the latest version of the plugin to mitigate this vulnerability.