The Daily Prayer Time WordPress plugin before 2022.03.01...
Critical severity
Unreviewed
Published
Apr 19, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Description
Published by the National Vulnerability Database
Apr 18, 2022
Published to the GitHub Advisory Database
Apr 19, 2022
Last updated
Jan 27, 2023
The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
References