vendor:
Testimonial
by:
IndiaNIC
8,8
CVSS
HIGH
XSS, CSRF, SQL Injection
79, 352, 89
CWE
Product Name: Testimonial
Affected Version From: 2.2
Affected Version To: 2.2
Patch Exists: NO
Related CWE: N/A
CPE: a:indianic:testimonial:2.2
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Wordpress
2020
Testimonial Plugin Vulnerabilities
Testimonial Plugin allows you to add, delete, edit and place what others said about your web site. This plugin is vulnerable to cross-site request forgery, cross-site scripting and sql injection. Proof of concept is provided in the text.
Mitigation:
Ensure that user input is properly sanitized and validated before being used in any SQL queries. Use a web application firewall to detect and block malicious requests. Implement a secure authentication mechanism.