Description
The SP Rental Manager WordPress plugin is vulnerable to SQL Injection via the orderby parameter found in the ~/user/shortcodes.php file which allows attackers to retrieve information contained in a site's database, in versions up to and including 1.5.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SP Rental Manager | SP Rental Manager | 1.5.3 – ≤ 1.5.3 | — |