CVE-2021-24390 Alipay <= 3.7.2 - Authenticated SQL Injection

2021-09-0611:09:19

CWE-89

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

45.2%

JSON

A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection.

CNA Affected

[
  {
    "product": "WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "3.7.2",
        "status": "affected",
        "version": "3.7.2",
        "versionType": "custom"
      }
    ]
  }
]