CVE-2021-24460

CWE-89 — SQL Injection3 documents3 sources
Severity
8.8HIGH
EPSS
0.5%
top 32.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
AYS PRO Popup Like BOX – Page PluginAys-pro Popup BOX
Timeline
PublishedAug 2
Latest updateMay 24

Description

The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5ays_pro/popup_like_box_–_page_plugin3.5.3 — 3.5.3
▶NVDays-pro/popup_box< 3.5.3

🔴Vulnerability Details

2
GHSA
GHSA-89p7-xf35-3wfq: The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3↗2022-05-24
▶
CVEList
Popup Like box - Page Plugin < 3.5.3 - Authenticated Blind SQL Injections↗2021-08-02
▶