CVE-2021-24285

CRITICALNuclei

Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24285 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 22, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Car Seller - Auto Classifieds Script

CVE List2.1.0 to ≤ 2.1.0affected

cars-seller-auto-classifieds-script

Browse cars-seller-auto-classifieds-script_project / cars-seller-auto-classifieds-script
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Car Seller - Auto Classifieds Script - SQL InjectionCVSS 9.8

The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitize, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL injection issue.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Apply the latest security patches or updates provided by the vendor to fix the SQL Injection vulnerability in the WordPress Car Seller - Auto Classifieds Script.

WeaknessesCWE-89
AuthorsShreyaPohekar
Template tagscve2021cvewordpresswp-pluginsqliwpscancars-seller-auto-classifieds-script_projectvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:cars-seller-auto-classifieds-script_project:cars-seller-auto-classifieds-script:*:*:*:*:*:wordpress:*:*
https://codevigilant.com/disclosure/2021/wp-plugin-cars-seller-auto-classifieds-script-sql-injection/ https://wpscan.com/vulnerability/f35d6ab7-dd52-48b3-a79c-3f89edf24162 https://codevigilant.com/disclosure/2021/24-04-2021-wp-plugin-cars-seller-auto-classifieds-script-sql-injection/ https://github.com/ARPSyndicate/kenzer-templates https://github.com/SexyBeast233/SecBooks

Source: ProjectDiscovery

References

3