CyberRota Analysis
AI-GeneratedThe Mageplaza Blog extension for Magento 2 versions up to 4.3.2 is vulnerable to SQL injection through the RelatedProduct block, allowing remote unauthenticated attackers to execute arbitrary SQL commands and access sensitive database information via the 'id' parameter. This vulnerability poses a high risk as it can lead to unauthorized data exposure and manipulation. Magento store operators and developers using this extension should prioritize immediate patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view.
Related CVEs
Other vulnerabilities affecting the same vendor(s)