Vulnerabilites related to Unknown - SiteGround Security
cve-2023-0234
Vulnerability from cvelistv5
Published
2023-02-06 19:59
Modified
2025-03-25 18:09
Summary
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.
Impacted products
Vendor Product Version
Unknown SiteGround Security Version: 0   < 1.3.1
Create a notification for this product.
Show details on NVD website


{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T05:02:44.113Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "exploit",
                     "vdb-entry",
                     "technical-description",
                     "x_transferred",
                  ],
                  url: "https://wpscan.com/vulnerability/acf3e369-1290-4b3f-83bf-2209b9dd06e1",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/namah-age/CVEs/blob/master/1.md",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.siteground.com/viewtos/responsible_disclosure_policy?scid=4&lang=en",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "HIGH",
                     baseScore: 8.8,
                     baseSeverity: "HIGH",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "HIGH",
                     privilegesRequired: "LOW",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2023-0234",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-25T18:09:23.123313Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-25T18:09:53.520Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://wordpress.org/plugins",
               defaultStatus: "unaffected",
               product: "SiteGround Security",
               vendor: "Unknown",
               versions: [
                  {
                     lessThan: "1.3.1",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "So Sakaguchi",
            },
            {
               lang: "en",
               type: "coordinator",
               value: "WPScan",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "CWE-89 SQL Injection",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-02-06T19:59:32.911Z",
            orgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            shortName: "WPScan",
         },
         references: [
            {
               tags: [
                  "exploit",
                  "vdb-entry",
                  "technical-description",
               ],
               url: "https://wpscan.com/vulnerability/acf3e369-1290-4b3f-83bf-2209b9dd06e1",
            },
            {
               url: "https://github.com/namah-age/CVEs/blob/master/1.md",
            },
            {
               url: "https://www.siteground.com/viewtos/responsible_disclosure_policy?scid=4&lang=en",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "SiteGround Security < 1.3.1 - Admin+ SQLi",
         x_generator: {
            engine: "WPScan CVE Generator",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
      assignerShortName: "WPScan",
      cveId: "CVE-2023-0234",
      datePublished: "2023-02-06T19:59:32.911Z",
      dateReserved: "2023-01-12T11:39:38.857Z",
      dateUpdated: "2025-03-25T18:09:53.520Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}