title: SEO Booster < 3.8 - Admin+ SQL Injection
description: The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST['order'][0]['dir'] parameter is not properly escaped leading to blind and error-based SQL injections.
problem types: CWE-89 SQL Injection
affected:
{
product: SEO Booster
vendor: Unknown
versions:
lessThan: 3.8, status: affected, version: 3.8, versionType: custom
}