WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service.

Successful exploitation of CVE-2023-54359 allows an attacker to extract sensitive data stored within the WordPress database. This could include user credentials, customer information, and potentially other confidential data depending on the plugin’s configuration and data storage practices. The time-based nature of the injection means data extraction is a slower process, but it doesn't prevent an attacker from systematically querying the database. Beyond data exfiltration, the attacker could also potentially cause a denial of service by injecting SQL code that disrupts database operations or corrupts data. The lack of authentication required significantly broadens the attack surface, making the vulnerability particularly concerning.

1. 已保留2026-04-09
2. 发布日期2026-04-09
3. 修改日期2026-04-15
4. EPSS 更新日期2026-04-17

The primary mitigation for CVE-2023-54359 is to immediately upgrade the adivaha Travel Plugin to version 2.4 or later, which contains the necessary fix. If upgrading is not immediately feasible, implement a Web Application Firewall (WAF) rule to filter requests to the /mobile-app/v3/ endpoint that contain suspicious characters or patterns in the 'pid' parameter. Specifically, look for XOR-based payloads or other SQL injection attempts. Consider using a WordPress security plugin with SQL injection protection capabilities. After upgrading, confirm the vulnerability is resolved by attempting a controlled injection test on the /mobile-app/v3/ endpoint with a benign SQL query.

最后更新

7.0最近