CVE-2023-1207 HTTP Headers < 1.18.8 - Admin+ SQL Injection

Q: What is CVE-2023-1207?

CVE-2023-1207 is a high-severity SQL injection vulnerability in Unknown HTTP Headers, published on 15 May 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Q: Is CVE-2023-1207 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1207 exists.

Q: How do I fix CVE-2023-1207?

No fix has been published for CVE-2023-1207 yet. Limit exposure of the affected software until one is available.

High 7.2 Published 15 May 2023 Updated 24 Jan 2025

An authenticated admin can execute arbitrary SQL queries via the import functionality, allowing data access or modification.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-1207?

CVE-2023-1207 is a high-severity SQL injection vulnerability in Unknown HTTP Headers, published on 15 May 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerability.

Which versions are affected by CVE-2023-1207?

It affects 1 product.

Products include Riverside Http Headers.

How do I fix CVE-2023-1207?

No fix has been published for CVE-2023-1207 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2023-1207 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1207 exists.

Sources

Also known as GHSA-qh8g-3pfr-79x6.