CVE-2024-30490 — AI Deep Analysis Summary

🚨 **Essence**: A critical SQL Injection (SQLi) flaw in the WordPress Plugin **ProfileGrid**.…

🛡️ **Root Cause**: **CWE-89** (SQL Injection). The flaw stems from **insufficient escaping** of the user-supplied `search` parameter.…

📦 **Affected**: **Metagauss**'s **ProfileGrid** plugin. 📉 **Versions**: All versions **up to and including 5.7.8**. 🌐 **Platform**: WordPress sites running this specific plugin.

🕵️ **Hackers Can**: Extract sensitive database data (User credentials, emails, posts). 🔄 **Modify** or **Delete** records.…

🔓 **Threshold**: **LOW**. 🚫 **Auth**: No authentication required (PR:N). 🖱️ **UI**: No user interaction needed (UI:N). 🌍 **Access**: Network accessible (AV:N). 📶 **Complexity**: Low (AC:L).…

🔍 **Public Exp?**: **YES**. A Proof of Concept (PoC) is available via **Nuclei Templates** on GitHub. 📂 **Link**: `projectdiscovery/nuclei-templates`.…

🔎 **Self-Check**: Use vulnerability scanners like **Nuclei** with the specific CVE template. 📝 **Manual**: Check if the site uses ProfileGrid < 5.7.8.…

🩹 **Official Fix**: **YES**. The vulnerability is tracked and patched. 📦 **Action**: Update ProfileGrid to a version **greater than 5.7.8**.…

🚧 **No Patch?**: **WAF Rules**: Block SQL injection patterns in the `search` parameter. 🛑 **Disable**: Temporarily disable the ProfileGrid plugin if not essential.…

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: **P1**. With CVSS Vector indicating **High Confidentiality** and **Low Complexity**, this is an active threat. 🏃 **Action**: Patch immediately.…