Lucene search

WPScanCVE-2024-5975

HistoryJul 30, 2024 - 6:15 a.m.

CVE-2024-5975

2024-07-3006:15:03

WPScan

web.nvd.nist.gov

wordpress plugin

sql injection

ajax action

unauthenticated users

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

22.1%

JSON

The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Affected configurations

Vulners

Vulnrichment

Node

loan_comparison_projectloan_comparisonRange≤1.1wordpress

VendorProductVersionCPE
loan_comparison_projectloan_comparison*cpe:2.3:a:loan_comparison_project:loan_comparison:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
loan_comparison_project	loan_comparison	*	cpe:2.3:a:loan_comparison_project:loan_comparison::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "CZ Loan Management",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "1.1"
      }
    ],
    "defaultStatus": "affected"
  }
]

References

wpscan.com/vulnerability/68f81943-b007-49c8-be9c-d0405b2ba4cf/

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

22.1%

JSON

Related for CVE-2024-5975