漏洞描述
WordPress Daily Prayer Time plugin prior to 2022.03.01 contains a SQL injection vulnerability.. It does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action, available to unauthenticated users, leading to SQL injection.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
wpscan.comhttps://wpscan.com/vulnerability/e1e09f56-89a4-4d6f-907b-3fb2cb825255↗wordpress.orghttps://wordpress.org/plugins/daily-prayer-time-for-mosques/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-0785↗github.comhttps://github.com/20142995/sectool↗github.comhttps://github.com/ARPSyndicate/cvemon↗