Skip to content
CVE Tracker
Back

CVE-2017-20103

Kama Click Counter Plugin admin.php Blind sql injection

Medium6.3EPSS 0.98%
Published
Updated
Reserved
Assigned by
VulDB

Description

A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument order_by/order with the input ASC%2c(select*from(select(sleep(2)))a) leads to sql injection (Blind). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.9 is able to address this issue. It is recommended to upgrade the affected component.

Scores

CVSS scores of CVE-2017-20103, by who scored it
Scored byCVSSScoreVector
VulDBCNA (assigner)3.1Medium6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVDNVD · Modified3.1High8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.98% · top 38% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: no · Technical impact: partial

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

Affected products

  • unspecified · Kama Click Counter Plugin

    • affected 3.4.0
    • affected 3.4.1
    • affected 3.4.2
    • affected 3.4.3
    • affected 3.4.4
    • affected 3.4.5
    • affected 3.4.6
    • affected 3.4.7
    • affected 3.4.8

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .