CVE-2024-0399

HIGH

WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-0399 has a selected CVSS score of 8.1 (high); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 15, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

WooCommerce Customers Manager

Default status: unaffected

CVE ListBefore 29.7affected

woocommerce_customers_manager

Browse woocommerce / woocommerce_customers_manager

Default status: unaffected

CVE ListBefore 29.7affected

Proofs of concept

2

Catalogued exploits

ExploitDBWooCommerce Customers Manager 29.4 - Post-Authenticated SQL InjectionExploitDB exploitby Ivan SpiridonovNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubxbz0n/CVE-2024-0399Repository PoCby xbz0n1Not analyzed1 file

4.1 KiB

GitHub
PoC details

References

2