JS Help Desk WordPress Plugin SQL Injection Vulnerability
Vulnerability
A SQL injection vulnerability has been identified in the JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress, specifically in version 2.8.2. This vulnerability arises from an incomplete fix for a previous SQL injection issue (CVE-2023-50839), leaving a second injection point with inadequate escaping of user-supplied values and insufficient preparation of the SQL query. As a result, unauthenticated attackers can manipulate existing SQL queries to extract sensitive information from the database.
Impact
Exploitation of this vulnerability allows for SQL injection, where attackers can append additional SQL commands to existing queries. This could be used to extract sensitive information from the database.
Remediation
Users are advised to update the JS Help Desk – AI-Powered Support & Ticketing System plugin to version 2.8.3 or a newer patched version.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.