CVE-2019-13578 - Vulnerability Details - OpenCVE

A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Givewp	Givewp

Configuration 1 [-]

cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://fortiguard.com/zeroday/FG-VD-19-098
https://github.com/impress-org/give/commit/894937d7927eab0c98457656cbd6fb414b3a6fbf
https://github.com/impress-org/give/commit/97b9b5fae2d10742ee42fe00092729fa7da3cb32
https://github.com/impress-org/give/commit/d91f4c6dcc92aeb826b060cb2feadd56885f4cea
https://wpvulndb.com/vulnerabilities/9504

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-08-15T15:36:43

Updated: 2024-08-04T23:57:39.410Z

Reserved: 2019-07-13T00:00:00

Link: CVE-2019-13578

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-08-15T16:15:11.947

Modified: 2024-11-21T04:25:14.960

Link: CVE-2019-13578

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-08-22T13:06:11", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/impress-org/give/commit/d91f4c6dcc92aeb826b060cb2feadd56885f4cea"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/impress-org/give/commit/97b9b5fae2d10742ee42fe00092729fa7da3cb32"}, {"tags": ["x_refsource_MISC"], "url": "https://wpvulndb.com/vulnerabilities/9504"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/impress-org/give/commit/894937d7927eab0c98457656cbd6fb414b3a6fbf"}, {"tags": ["x_refsource_MISC"], "url": "https://fortiguard.com/zeroday/FG-VD-19-098"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-13578", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/impress-org/give/commit/d91f4c6dcc92aeb826b060cb2feadd56885f4cea", "refsource": "MISC", "url": "https://github.com/impress-org/give/commit/d91f4c6dcc92aeb826b060cb2feadd56885f4cea"}, {"name": "https://github.com/impress-org/give/commit/97b9b5fae2d10742ee42fe00092729fa7da3cb32", "refsource": "MISC", "url": "https://github.com/impress-org/give/commit/97b9b5fae2d10742ee42fe00092729fa7da3cb32"}, {"name": "https://wpvulndb.com/vulnerabilities/9504", "refsource": "MISC", "url": "https://wpvulndb.com/vulnerabilities/9504"}, {"name": "https://github.com/impress-org/give/commit/894937d7927eab0c98457656cbd6fb414b3a6fbf", "refsource": "MISC", "url": "https://github.com/impress-org/give/commit/894937d7927eab0c98457656cbd6fb414b3a6fbf"}, {"name": "https://fortiguard.com/zeroday/FG-VD-19-098", "refsource": "MISC", "url": "https://fortiguard.com/zeroday/FG-VD-19-098"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T23:57:39.410Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/impress-org/give/commit/d91f4c6dcc92aeb826b060cb2feadd56885f4cea"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/impress-org/give/commit/97b9b5fae2d10742ee42fe00092729fa7da3cb32"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wpvulndb.com/vulnerabilities/9504"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/impress-org/give/commit/894937d7927eab0c98457656cbd6fb414b3a6fbf"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://fortiguard.com/zeroday/FG-VD-19-098"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-13578", "datePublished": "2019-08-15T15:36:43", "dateReserved": "2019-07-13T00:00:00", "dateUpdated": "2024-08-04T23:57:39.410Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "D14FD4DF-18BC-478A-A2BA-7ACE3C1CC065", "versionEndIncluding": "2.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de inyecci\u00f3n SQL en el plugin Impress GiveWP Give versiones hasta 2.5.0 para WordPress. La explotaci\u00f3n con \u00e9xito de esta vulnerabilidad permitir\u00eda a un atacante remoto ejecutar comandos SQL arbitrarios en el sistema afectado por medio del archivo includes/payments/class-payments-query.php."}], "id": "CVE-2019-13578", "lastModified": "2024-11-21T04:25:14.960", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-08-15T16:15:11.947", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://fortiguard.com/zeroday/FG-VD-19-098"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/impress-org/give/commit/894937d7927eab0c98457656cbd6fb414b3a6fbf"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/impress-org/give/commit/97b9b5fae2d10742ee42fe00092729fa7da3cb32"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/impress-org/give/commit/d91f4c6dcc92aeb826b060cb2feadd56885f4cea"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://wpvulndb.com/vulnerabilities/9504"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://fortiguard.com/zeroday/FG-VD-19-098"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/impress-org/give/commit/894937d7927eab0c98457656cbd6fb414b3a6fbf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/impress-org/give/commit/97b9b5fae2d10742ee42fe00092729fa7da3cb32"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/impress-org/give/commit/d91f4c6dcc92aeb826b060cb2feadd56885f4cea"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://wpvulndb.com/vulnerabilities/9504"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}