CVE-2024-30490

CRITICALNuclei

WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-30490 has a selected CVSS score of 9.3 (critical); EIP currently links 1 Nuclei template.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 8, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

ProfileGrid

Browse Metagauss / ProfileGridprofilegrid-user-profiles-groups-and-communities

Default status: unaffected

CVE ListThrough 5.7.8affected

profilegrid

Browse metagauss / profilegrid

Default status: unaffected

CVE ListThrough 5.7.8affected

Nuclei templates

1
ProjectDiscoveryCRITICALProfileGrid <= 5.7.8 - SQL Injection

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.7.8 due to insufficient escaping on the user supplied 'search' parameter and lack of sufficient preparation on the existing SQL query.

Impact

Attackers can execute arbitrary SQL queries, potentially leading to data theft, data tampering, or database compromise.

Remediation

Update to ProfileGrid version 5.7.9 or later.

AuthorsShivam Kamboj
Template tagscvecve2024wordpresswpwp-pluginprofilegridsqli
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/profilegrid-user-profiles-groups-and-communities/profilegrid-578-unauthenticated-sql-injection https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/ https://nvd.nist.gov/vuln/detail/CVE-2024-30490

Source: ProjectDiscovery

References

2