CVE-2020-9006 SQL injection in n/a
SQL injection via deserialization in Popup Builder allows attackers to create admin accounts and execute remote code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9006?
CVE-2020-9006 is a critical SQL injection vulnerability in n/a, published on 17 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)
Which versions are affected by CVE-2020-9006?
It affects 1 product.
Products include Sygnoos Popup Builder.
How do I fix CVE-2020-9006?
No fix has been published for CVE-2020-9006 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-9006 being exploited?
There is no known exploitation of CVE-2020-9006 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2022-0479 Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting
- CVE-2019-14695 SQL injection in n/a
- CVE-2021-25082 Popup Builder < 4.0.7 - LFI to RCE
- CVE-2023-6696 Missing authorization in Popup Builder – Create highly converting, mobile friendly marketing popups.
- CVE-2023-6294 popup-builder < 4.2.6 - Admin+ SSRF & File Read
Sources
Also known as GHSA-7w63-rpf8-69q7.