CVE-2021-24285

🗓️ 14 May 2021 11:38:17Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 71 Views🌐 WEB

The request_list_request AJAX call of Car Seller plugin through 2.1.0, allows SQL Injection

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2021-24285	27 Apr 202309:58	–	circl
CNNVD	WordPress 插件 SQL注入漏洞	14 May 202100:00	–	cnnvd
CNVD	WordPress plugin SQL injection vulnerability	20 May 202100:00	–	cnvd
Check Point Advisories	UNION Query-based SQL Injection Over HTTP Traffic (CVE-2018-17254; CVE-2020-18144; CVE-2020-29283; CVE-2020-29287; CVE-2020-29288; CVE-2020-35430; CVE-2021-24285)	18 Apr 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-24285 Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection	14 May 202111:38	–	cvelist
Nuclei	WordPress Car Seller - Auto Classifieds Script - SQL Injection	2 Jun 202610:14	–	nuclei
NVD	CVE-2021-24285	14 May 202112:15	–	nvd
Patchstack	WordPress Car Seller – Auto Classifieds Script plugin <= 2.1.0 - Unauthenticated SQL Injection (SQLi) vulnerability	26 Apr 202100:00	–	patchstack
Prion	Sql injection	14 May 202112:15	–	prion
RedhatCVE	CVE-2021-24285	22 May 202521:03	–	redhatcve

NVD

Vulners

Node

cars-seller-auto-classifieds-script_project cars-seller-auto-classifieds-scriptRange≤2.1.0wordpress

[
  {
    "product": "Car Seller - Auto Classifieds Script",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "2.1.0",
        "status": "affected",
        "version": "2.1.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/f35d6ab7-dd52-48b3-a79c-3f89edf24162
codevigilant	www.codevigilant.com/disclosure/2021/24-04-2021-wp-plugin-cars-seller-auto-classifieds-script-sql-injection/

Parameter	Position	Path	Description	CWE
order_id	request body	/wp-admin/admin-ajax.php	SQL injection via unsanitised order_id parameter in request_list_request AJAX call	CWE-89

21 Nov 2024 05:52Current

9.8High risk

Vulners AI Score9.8

CVSS 27.5

CVSS 3.19.8

EPSS0.89408