CVE-2017-20249
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Apptha Slider Gallery plugin version 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the albid parameter. Attackers can send GET requests with crafted SQL payloads in the albid parameter to extract sensitive database information including user credentials and authentication hashes.
Risk Assessment
The risk for the organization is the possibility of unauthorized access to the database, which can lead to the leakage of confidential data such as user login credentials and potential system takeover.
Recommendation
It is recommended to immediately update the Apptha Slider Gallery plugin to the latest available version that fixes this vulnerability, or remove it entirely if it is not essential.
Other vulnerabilities in Apptha Slider Gallery
Original NVD description (English source)
Apptha Slider Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the albid parameter. Attackers can send GET requests with crafted SQL payloads in the albid parameter to extract sensitive database information including user credentials and authentication hashes.