Askeet Talk To Your Woocommerce Data
Monthly
SQL injection in the Askeet - Talk to Your WooCommerce Data plugin (all versions through 3.0) enables authenticated administrators to exfiltrate arbitrary data from the WordPress database by exploiting a filter bypass in the plugin's query sanitization routine. The `askeet_is_safe_query()` function strips standard MySQL block comments before scanning for forbidden keywords, but fails to account for MySQL's conditional comment syntax (e.g., `/*!UNION*/`), which MySQL executes as live SQL while the filter treats it as a comment. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at the time of analysis; EPSS data was not included in the available intelligence.
SQL injection in the Askeet - Talk to Your WooCommerce Data plugin (all versions through 3.0) enables authenticated administrators to exfiltrate arbitrary data from the WordPress database by exploiting a filter bypass in the plugin's query sanitization routine. The `askeet_is_safe_query()` function strips standard MySQL block comments before scanning for forbidden keywords, but fails to account for MySQL's conditional comment syntax (e.g., `/*!UNION*/`), which MySQL executes as live SQL while the filter treats it as a comment. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at the time of analysis; EPSS data was not included in the available intelligence.