cve/2021/CVE-2021-25023.md

### [CVE-2021-25023](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25023)
![](https://img.shields.io/static/v1?label=Product&message=Speed%20Booster%20Pack%20%E2%9A%A1%20PageSpeed%20Optimization%20Suite&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=4.3.3.1%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)

### Description

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related table, leading to an SQL injection

### POC

#### Reference
- https://wpscan.com/vulnerability/4a27d374-f690-4a8a-987a-9e0f56bbe143

#### Github
- https://github.com/20142995/nuclei-templates