cve/2023/CVE-2023-2114.md

CVE-2023-2114

Description

The NEX-Forms WordPress plugin before 8.4 does not properly escape the table parameter, which is populated with user input, before concatenating it to an SQL query.

POC

Reference

• https://wpscan.com/vulnerability/3d8ab3a5-1bf8-4216-91fa-e89541e5c43d

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/SchmidAlex/nex-forms_SQL-Injection
• https://github.com/SchmidAlex/nex-forms_SQL-Injection-CVE-2023-2114
• https://github.com/nomi-sec/PoC-in-GitHub