### [CVE-2024-0566](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0566)
![](https://img.shields.io/static/v1?label=Product&message=Smart%20Manager&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%208.28.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brighgreen)

### Description

The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

### POC

#### Reference
- https://wpscan.com/vulnerability/ca83db95-4a08-4615-aa8d-016022404c32/

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/xbz0n/CVE-2024-0566