Lucene search
PRIOn knowledge basePRION:CVE-2021-24846HistoryDec 21, 2021 - 9:15 a.m.
Sql injection
2021-12-2109:15:00
PRIOn knowledge base
www.prio-n.com
2
The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber
| CPE | Name | Operator | Version |
|---|---|---|---|
| ni_woocommerce_custom_order_status | lt | 1.9.7 |
Related
cve
cve
CVE-2021-24846
2021-12-21 09:15:07
wpvulndb
wpvulndb
Ni WooCommerce Custom Order Status < 1.9.7 - Subscriber+ SQL Injection
2021-11-22 00:00:00
cvelist
cvelist
patchstack
patchstack
cnvd
cnvd
nvd
nvd
CVE-2021-24846
2021-12-21 09:15:07
wpexploit
wpexploit
Ni WooCommerce Custom Order Status < 1.9.7 - Subscriber+ SQL Injection
2021-11-22 00:00:00