SQL Injection and XSS in Supsystic Pricing Table Plugin

Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and 'Edit HTML' fields that execute malicious scripts when viewing pricing tables.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Supsystic Pricing Table version 1.8.7 suffers from multiple critical input validation flaws that expose WordPress installations to unauthenticated attack. An SQL injection vulnerability in the 'sidx' GET parameter allows attackers to execute arbitrary database queries without authentication, while stored XSS vulnerabilities in the 'Edit name' and 'Edit HTML' fields enable persistent malicious script injection. With a CVSS score of 8.2, this vulnerability affects any WordPress site running the vulnerable plugin version, putting customer data, pricing information, and site integrity at immediate risk. The unauthenticated nature of the SQL injection attack makes this particularly dangerous, as no valid credentials are required to exploit it.

Casky's 301 mapped skills leverage Claude AI with extended reasoning to correlate attack patterns across MITRE ATT&CK Reconnaissance (TA0001) and Resource Development (TA0043) phases, alongside the CWE-89 SQL injection root cause. Practitioners using Casky would observe detection patterns identifying: (1) abnormal GET parameter manipulation attempts targeting the getListForTbl action, (2) SQL syntax signatures in request payloads indicating injection attempts, (3) script tag injection patterns in form field submissions, and (4) stored payload execution chains when pricing tables are rendered. The platform's extended reasoning capability would connect these disparate indicators—reconnaissance queries probing database structure, followed by resource development to refine payload delivery—into a cohesive attack narrative, enabling security teams to identify and respond to exploitation attempts before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2020-37243.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2020-37243

Casky has 301 skills that investigate the attack patterns behind CVE-2020-37243. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn