CVE-2017-1002009

Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
larry_cashdollarCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
VendorProductVersion
ontraportmembership_simplified
1.58
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://membership.officeautopilot.com/get-it-now/
http://www.vapidlabs.com/advisory.php?v=188
http://membership.officeautopilot.com/get-it-now/
http://www.vapidlabs.com/advisory.php?v=188