CVE-2021-24952 Conversios.io < 4.6.2 - Subscriber+ SQL Injection

2022-03-0708:16:08

CWE-89

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

37.7%

JSON

The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_product_sync_bantch_wise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks.

CNA Affected

[
  {
    "product": "Conversios.io – Google Analytics and Google Shopping plugin for WooCommerce",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "4.6.2",
        "status": "affected",
        "version": "4.6.2",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/cbb8fa9f-1c84-4410-ae86-64cb1771ce78

0.001 Low

EPSS

Percentile

37.7%

JSON

Related for CVELIST:CVE-2021-24952