CVE-2017-1002009

EUVD-2017-1624
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
ontraportmembership_simplified
1.58
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://membership.officeautopilot.com/get-it-now/
http://www.vapidlabs.com/advisory.php?v=188
http://membership.officeautopilot.com/get-it-now/
http://www.vapidlabs.com/advisory.php?v=188