Headline
CVE-2023-5430: Changeset 2985559 for jquery-news-ticker – WordPress Plugin Repository
The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Timestamp:
10/29/2023 08:48:22 AM (2 days ago)
gopiplus@…
Message:
Tested up to 6.4
Location:
jquery-news-ticker/trunk
Files:
- inc/jquery-news-ticker.js (1 diff)
- jquery-news-ticker.php (2 diffs)
- readme.txt (3 diffs)
Legend:
Unmodified
Added
Removed
jquery-news-ticker/trunk/inc/jquery-news-ticker.js
r2135635
r2985559
1
1
/\*
2
2
Jquery news ticker plugin
3
Copyright (C) 2011 - 2019 www.gopiplus.com
3
Copyright (C) 2011 - 2023 www.gopiplus.com
4
4
5
5
This program is free software: you can redistribute it and/or modify
jquery-news-ticker/trunk/jquery-news-ticker.php
r2651551
r2985559
4
4
Description: Jquery news ticker plugin brings a lightweight, flexible and easy to configure news ticker plugin to wordpress website. This plugin adds scrolling horizontal tickers to your site.
5
5
Author: Gopi Ramasamy
6
Version: 3.0
6
Version: 3.1
7
7
Plugin URI: http://www.gopiplus.com/work/2013/10/03/jquery-news-ticker-wordpress-plugin/
8
8
Author URI: http://www.gopiplus.com/work/2013/10/03/jquery-news-ticker-wordpress-plugin/
…
…
83
83
if($Jntp\_group <> "" )
84
84
{
85
$sSql = $sSql . " and Jntp\_group='$Jntp\_group'";
85
$sSql = $sSql . " and Jntp\_group = %s ";
86
$sSql = $wpdb->prepare($sSql, $Jntp\_group);
86
87
}
87
88
jquery-news-ticker/trunk/readme.txt
r2827068
r2985559
6
6
Tags: jquery, ticker, news
7
7
Requires at least: 3.6
8
Tested up to: 6.1
9
Stable tag: 3.0
8
Tested up to: 6.4
9
Stable tag: 3.1
10
10
License: GPLv2 or later
11
11
License URI: http://www.gnu.org/licenses/gpl-2.0.html
…
…
155
155
1\. Tested up to 5.9
156
156
157
\= 3.1 =
158
159
1\. Tested up to 6.4
160
157
161
\== Upgrade Notice ==
158
162
…
…
247
251
248
252
1\. Tested up to 5.9
253
254
\= 3.1 =
255
256
1\. Tested up to 6.4
Note: See TracChangeset for help on using the changeset viewer.