Description
The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | CP Image Store with Slideshow | 1.0.68 – < 1.0.68 | 1.0.68 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- CP Image Store with Slideshow <= 1.0.67 - SQL Injection http/cves/2022/CVE-2022-1692.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.