CVE-2024-6926

CRITICALNuclei

Viral Signup <= 2.1 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-6926 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 4, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Viral Signup

Default status: affected

CVE ListThrough 2.1affected

viral-signup

Browse wow-company / viral-signup

Default status: unknown

CVE ListThrough 2.1affected

Nuclei templates

1
ProjectDiscoveryCRITICALViral Signup <= 2.1 - SQL InjectionCVSS 9.8

The Viral Signup limited opt-in with viral referral sharing plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Impact

Unauthenticated attackers can exploit SQL injection to extract, modify, or delete sensitive database information, potentially gaining full control of the WordPress site and compromising user data.

Remediation

Update Viral Signup plugin to a version later than 2.1 to address the SQL injection vulnerability.

Authorss4e-io
Template tagstime-based-sqlicvecve2024wpscanwp-pluginwordpressviral-signupvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
https://www.usom.gov.tr/bildirim/tr-24-1387 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/viral-signup/viral-signup-21-unauthenticated-sql-injection https://wpscan.com/vulnerability/9ce96ce5-fcf0-4d7a-b562-f63ea3418d93/ https://nvd.nist.gov/vuln/detail/CVE-2024-6926

Source: ProjectDiscovery

References

2