Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-8705— ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection

Quick assessment

Affected
clearsale ClearSale Total
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Clear Sale ClearSale Total是Clear Sale组织的一款面向电商交易的欺诈风险识别与订单保护系统。 Clear Sale ClearSale Total 3.4.2及之前版本存在SQL注入漏洞，该漏洞源于通过 POST参数在 AJAX操作中SQL注入攻击，未经验证的攻击者可能利用PHP小于8.0环境下的类型松散比较绕过switch检查，追加SQL查询以提取敏感信息。

CVSS 7.5 · High EPSS 0.68% · P51

Affected Version Matrix 1

VendorProduct Version RangeStatus
clearsale ClearSale Total <= 3.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-8705

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection
Source: CVE Program / CVE List V5
Vulnerability Description
The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in all versions up to, and including, 3.4.2. The handler is registered for unauthenticated users (`wp_ajax_nopriv_clearsale_total_push`), and although a `wp_verify_nonce()` check exists, the failing branch's `die()` is commented out so execution continues regardless of nonce validity. On PHP < 8.0 the attacker-supplied `$metodo` value bypasses the `switch ($metodo) { case 4: ... }` guard via loose type juggling (the string `"4 AND SLEEP(5)"` compares equal to integer `4`), reaching an unquoted `UPDATE wp_cs_total_dadosextras SET metodo=$metodo, ...` query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the target server to be running PHP < 8.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Clear Sale ClearSale Total SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Clear Sale ClearSale Total是Clear Sale组织的一款面向电商交易的欺诈风险识别与订单保护系统。 Clear Sale ClearSale Total 3.4.2及之前版本存在SQL注入漏洞，该漏洞源于通过`pagseguro[metodo]` POST参数在`clearsale_total_push` AJAX操作中SQL注入攻击，未经验证的攻击者可能利用PHP小于8.0环境下的类型松散比较绕过switch检查，追加SQL查询以提取敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
clearsale ClearSale Total <= 3.4.2 -

II. Public POCs for CVE-2026-8705

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-8705

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-8705 (3)

Vendor Pages for CVE-2026-8705 (1)

Other References for CVE-2026-8705 (1)

IV. Related Vulnerabilities

Same weakness: CWE-89

V. Comments for CVE-2026-8705

No comments yet

Leave a comment