CVE-2021-4134 — SQL Injection in Fancy Product Designer

CWE-89 — SQL Injection3 documents3 sources
Severity
4.9MEDIUMNVD
CNA7.2
EPSS
1.2%
top 20.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Radykal Fancy Product DesignerFancy Product Designer
Timeline
PublishedFeb 16
Latest updateFeb 17

Description

The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-mp27-fcc3-85qx: The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found↗2022-02-17
▶
CVEList
Fancy Product Designer <= 4.7.4 Admin+ SQL Injection↗2022-02-16
▶
CVE-2021-4134 — SQL Injection in Fancy Product Designer | cvebase