CVE-2021-24484

CWE-89 — SQL Injection3 documents3 sources
Severity
7.2HIGH
EPSS
0.6%
top 31.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
AYS PRO Secure Copy Content Protection AND Content LockingAys-pro Secure Copy Content Protection AND Content Locking
Timeline
PublishedAug 2
Latest updateMay 24

Description

The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-4mw6-mpc3-jcw5: The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2↗2022-05-24
▶
CVEList
Secure Copy Content Protection and Content Locking < 2.6.7 - Authenticated Blind SQL Injections↗2021-08-02
▶
CVE-2021-24484 (HIGH CVSS 7.2) | The get_reports() function in the S | cvebase.io