CVE-2024-1061

HIGHNuclei

bplugins html5_video_player Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2024-1061 has a selected CVSS score of 8.6 (high); EIP currently links 1 Nuclei template.

Description

The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the  'get_view' function.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Feb 14, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 31, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

html5_video_player

Browse bplugins / html5_video_player
VulnCheckVersion data not supplied

html5-video-player

Default status: unaffected

CVE ListBefore 2.5.25affected

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress HTML5 Video Player - SQL InjectionCVSS 9.8

WordPress HTML5 Video Player plugin is vulnerable to SQL injection. An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks, potentially leading to unauthorized access, data leakage, or further compromise of the WordPress site.

Remediation

Vendor did not acknowledge vulnerability but the issue seems to have been fixed in version 2.5.25.

WeaknessesCWE-89
Authorsxxcdd
Template tagstime-based-sqlicvecve2024wpwordpresswp-pluginsqlihtml5-video-playerbpluginsvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:bplugins:html5_video_player:*:*:*:*:*:wordpress:*:*
FOFA: "wordpress" && body="html5-video-player"
https://www.tenable.com/security/research/tra-2024-02 https://wordpress.org/plugins/html5-video-player https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1061 https://github.com/tanjiti/sec_profile https://github.com/JoshuaMart/JoshuaMart

Source: ProjectDiscovery

References

2