.. / CVE-2023-1020

• SQLi
• Nuclei
• Web

Exploit for Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection (CVE-2023-1020)

Description:

The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Nuclei Template

View the template here CVE-2023-1020.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-1020.yaml

References: