CVE-2021-24285

Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection

EPSS 14.7%CWE-89

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS —EPSS 14.7%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

14 May 2021Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.

Affected products

Unknown · Car Seller - Auto Classifieds Script

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://codevigilant.com/disclosure/2021/24-04-2021-wp-plugin-cars-seller-auto-classifieds-script-sql-injection/https://wpscan.com/vulnerability/f35d6ab7-dd52-48b3-a79c-3f89edf24162