CVE-2024-0566

HIGH

Smart Manager < 8.28.0 - Admin+ SQL Injection

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-0566 has a selected CVSS score of 7.2 (high); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 12, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Smart Manager

Default status: unaffected

CVE ListBefore 8.28.0affected

Proofs of concept

2

Catalogued exploits

ExploitDBSmart Manager 8.27.0 - Post-Authenticated SQL InjectionExploitDB exploitby Ivan SpiridonovNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubxbz0n/CVE-2024-0566Repository PoCby xbz0n1Not analyzed1 file

3.2 KiB

GitHub
PoC details

References

2