Unauthenticated SQL Injection in WordPress Contest Gallery Plugin <= 24.0.3

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery - Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection 2. Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 3. CVSS Score: 9.8 (Critical) 4. Public Release Date: November 4, 2024 5. Update Date: November 5, 2024 6. Researcher: shaman0x01 - Shaman Red Team 7. Affected Versions: <= 24.0.3 8. Fixed Version: 24.0.4 9. Vulnerability Description: This plugin contains an unauthenticated SQL injection vulnerability in all versions (including 24.0.3) due to insufficient escaping of the parameter within user-supplied inputs, and inadequate preparation within existing SQL queries. This allows unauthorized attackers to inject additional SQL queries into existing queries, enabling them to extract sensitive information from the database. 10. Reference Link: plugins.trac.wordpress.org 11. Remediation Recommendation: Upgrade to version 24.0.4 or a later patched version. 12. Vulnerability Database: Wordfence Intelligence Vulnerability Database 13. API: The Wordfence Intelligence Vulnerability Database API is free to query and utilize, available for both personal and commercial use, and includes the same vulnerability data as the user interface. 14. Documentation: Documentation on how to query vulnerability data via the API. 15. Notification: Wordfence offers free personal and commercial API access, along with free Webhook integration, to ensure your WordPress site stays ahead of the latest vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated SQL Injection in WordPress Contest Gallery Plugin <= 24.0.3

More from this source