CVE-2024-2879
CRITICAL EXPLOITED NUCLEIWordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection
Title source: nucleiExploitation Summary
CVE-2024-2879 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including herculeszxc. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository provides a scanner for CVE-2024-2879, an unauthenticated SQL injection vulnerability in LayerSlider WordPress plugin versions 7.9.11 and 7.10.0. The scanner checks for vulnerable versions by analyzing HTTP responses and includes manual testing instructions.
Description
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Exploits (1)
This repository provides a scanner for CVE-2024-2879, an unauthenticated SQL injection vulnerability in LayerSlider WordPress plugin versions 7.9.11 and 7.10.0. The scanner checks for vulnerable versions by analyzing HTTP responses and includes manual testing instructions.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H