Search criteria

4 vulnerabilities found for Five Minute Webshop by Unknown

CVE-2022-1686 (GCVE-0-2022-1686)

Vulnerability from nvd – Published: 2022-06-06 08:51 – Updated: 2024-08-03 00:10
VLAI
Title
Five Minute Webshop <= 1.3.2 - Admin+ SQLi via id
Summary
The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Unknown Five Minute Webshop Affected: 1.3.2 , ≤ 1.3.2 (custom)
Create a notification for this product.
Credits
Daniel Krohmer (Fraunhofer IESE) Shi Chen (University of Kaiserslautern)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.913Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/1a5ce0dd-6847-42e7-8d88-3b63053fab71"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Five Minute Webshop",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThanOrEqual": "1.3.2",
              "status": "affected",
              "version": "1.3.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Daniel Krohmer (Fraunhofer IESE)"
        },
        {
          "lang": "en",
          "value": "Shi Chen (University of Kaiserslautern)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-06T08:51:20.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/1a5ce0dd-6847-42e7-8d88-3b63053fab71"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_2"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Five Minute Webshop \u003c= 1.3.2 - Admin+ SQLi via id",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-1686",
          "STATE": "PUBLIC",
          "TITLE": "Five Minute Webshop \u003c= 1.3.2 - Admin+ SQLi via id"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Five Minute Webshop",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "1.3.2",
                            "version_value": "1.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Daniel Krohmer (Fraunhofer IESE)"
          },
          {
            "lang": "eng",
            "value": "Shi Chen (University of Kaiserslautern)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/1a5ce0dd-6847-42e7-8d88-3b63053fab71",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/1a5ce0dd-6847-42e7-8d88-3b63053fab71"
            },
            {
              "name": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_2",
              "refsource": "MISC",
              "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_2"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-1686",
    "datePublished": "2022-06-06T08:51:20.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:10:03.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1685 (GCVE-0-2022-1685)

Vulnerability from nvd – Published: 2022-06-06 08:51 – Updated: 2024-08-03 00:10
VLAI
Title
Five Minute Webshop <= 1.3.2 - Admin+ SQLi via orderby
Summary
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Unknown Five Minute Webshop Affected: 1.3.2 , ≤ 1.3.2 (custom)
Create a notification for this product.
Credits
Daniel Krohmer (Fraunhofer IESE) Shi Chen (University of Kaiserslautern)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.847Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Five Minute Webshop",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThanOrEqual": "1.3.2",
              "status": "affected",
              "version": "1.3.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Daniel Krohmer (Fraunhofer IESE)"
        },
        {
          "lang": "en",
          "value": "Shi Chen (University of Kaiserslautern)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-06T08:51:18.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Five Minute Webshop \u003c= 1.3.2 - Admin+ SQLi via orderby",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-1685",
          "STATE": "PUBLIC",
          "TITLE": "Five Minute Webshop \u003c= 1.3.2 - Admin+ SQLi via orderby"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Five Minute Webshop",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "1.3.2",
                            "version_value": "1.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Daniel Krohmer (Fraunhofer IESE)"
          },
          {
            "lang": "eng",
            "value": "Shi Chen (University of Kaiserslautern)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97"
            },
            {
              "name": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1",
              "refsource": "MISC",
              "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-1685",
    "datePublished": "2022-06-06T08:51:19.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:10:03.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1686 (GCVE-0-2022-1686)

Vulnerability from cvelistv5 – Published: 2022-06-06 08:51 – Updated: 2024-08-03 00:10
VLAI
Title
Five Minute Webshop <= 1.3.2 - Admin+ SQLi via id
Summary
The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Unknown Five Minute Webshop Affected: 1.3.2 , ≤ 1.3.2 (custom)
Create a notification for this product.
Credits
Daniel Krohmer (Fraunhofer IESE) Shi Chen (University of Kaiserslautern)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.913Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/1a5ce0dd-6847-42e7-8d88-3b63053fab71"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Five Minute Webshop",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThanOrEqual": "1.3.2",
              "status": "affected",
              "version": "1.3.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Daniel Krohmer (Fraunhofer IESE)"
        },
        {
          "lang": "en",
          "value": "Shi Chen (University of Kaiserslautern)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-06T08:51:20.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/1a5ce0dd-6847-42e7-8d88-3b63053fab71"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_2"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Five Minute Webshop \u003c= 1.3.2 - Admin+ SQLi via id",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-1686",
          "STATE": "PUBLIC",
          "TITLE": "Five Minute Webshop \u003c= 1.3.2 - Admin+ SQLi via id"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Five Minute Webshop",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "1.3.2",
                            "version_value": "1.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Daniel Krohmer (Fraunhofer IESE)"
          },
          {
            "lang": "eng",
            "value": "Shi Chen (University of Kaiserslautern)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/1a5ce0dd-6847-42e7-8d88-3b63053fab71",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/1a5ce0dd-6847-42e7-8d88-3b63053fab71"
            },
            {
              "name": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_2",
              "refsource": "MISC",
              "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_2"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-1686",
    "datePublished": "2022-06-06T08:51:20.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:10:03.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1685 (GCVE-0-2022-1685)

Vulnerability from cvelistv5 – Published: 2022-06-06 08:51 – Updated: 2024-08-03 00:10
VLAI
Title
Five Minute Webshop <= 1.3.2 - Admin+ SQLi via orderby
Summary
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Unknown Five Minute Webshop Affected: 1.3.2 , ≤ 1.3.2 (custom)
Create a notification for this product.
Credits
Daniel Krohmer (Fraunhofer IESE) Shi Chen (University of Kaiserslautern)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.847Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Five Minute Webshop",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThanOrEqual": "1.3.2",
              "status": "affected",
              "version": "1.3.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Daniel Krohmer (Fraunhofer IESE)"
        },
        {
          "lang": "en",
          "value": "Shi Chen (University of Kaiserslautern)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-06T08:51:18.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Five Minute Webshop \u003c= 1.3.2 - Admin+ SQLi via orderby",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-1685",
          "STATE": "PUBLIC",
          "TITLE": "Five Minute Webshop \u003c= 1.3.2 - Admin+ SQLi via orderby"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Five Minute Webshop",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "1.3.2",
                            "version_value": "1.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Daniel Krohmer (Fraunhofer IESE)"
          },
          {
            "lang": "eng",
            "value": "Shi Chen (University of Kaiserslautern)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97"
            },
            {
              "name": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1",
              "refsource": "MISC",
              "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-1685",
    "datePublished": "2022-06-06T08:51:19.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:10:03.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}