CVE-2023-2805 — SupportCandy < 3.1.7 - Admin+ SQLi
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL st…
Published: 2023-06-19 · CVSS: Unscored
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7