CVE-2017-20246
HighCVSS 8.2Summary
The KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to read database contents by exploiting an unescaped GET parameter.
Risk Assessment
Attackers can gain access to sensitive database information, potentially leading to serious data security breaches for the organization.
Recommendation
It is recommended to update the KittyCatfish plugin to the latest version and review and secure all GET parameters in the application.
Original NVD description (English source)
KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to read database contents by exploiting an unescaped GET parameter. Attackers can inject SQL code through the 'kc_ad' parameter in base.css.php or kittycatfish.php to extract sensitive database information using boolean-based blind or time-based blind techniques.