CVE-2019-25746

Popis

WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the -post- parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious -post- values to extract sensitive database information or modify data.