CVE-2021-24285 — AI Deep Analysis Summary

🚨 **Essence**: SQL Injection (SQLi) in 'Car Seller - Auto Classifieds Script' WP plugin. 💥 **Consequences**: Attackers can manipulate SQL queries via the `order_id` POST parameter.…

🛡️ **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command. 🔍 **Flaw**: The plugin fails to sanitize, validate, or escape the `order_id` parameter before injecting it into SQL statements.…

📦 **Product**: Car Seller - Auto Classifieds Script WordPress Plugin. 📅 **Affected Versions**: Version 2.1.0 and all previous versions. 🏢 **Vendor**: Unknown.

🕵️ **Privileges**: Exploitable by both **Authenticated** and **Unauthenticated** users. 💾 **Data Impact**: Full SQL injection capabilities.…

⚡ **Threshold**: LOW. 🚪 **Auth**: No authentication required! The vulnerability exists in the `request_list_request` AJAX call, accessible to anyone visiting the site. This makes it extremely easy to exploit.

🔓 **Public Exp?**: YES. 📄 **PoC**: Available via Nuclei templates (projectdiscovery/nuclei-templates).…

🔍 **Self-Check**: Scan for the specific WordPress plugin 'Car Seller - Auto Classifieds Script'.…

🩹 **Fix**: Update the plugin to a version newer than 2.1.0. 📢 **Official Patch**: The vendor should release a patched version. Until then, refer to the vendor's disclosure links for updates.…

🚧 **No Patch?**: 1. Disable/Deactivate the plugin immediately. 2. Implement WAF rules to block SQL injection patterns in `order_id` POST parameters. 3. Monitor logs for suspicious SQL activity. 4.…

🔥 **Urgency**: HIGH. 🚨 **Priority**: Critical. Since it affects unauthenticated users and has public PoCs, immediate action is required. Patch or disable the plugin ASAP to prevent data breaches.