CVE-2024-1813 — Deserialization of Untrusted Data in Simple JOB Board

CWE-502 — Deserialization of Untrusted Data3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
8.0%
top 7.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Presstigers Simple JOB Board
Timeline
PublishedApr 9

Description

The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code when a submitte…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields↗2024-04-09
▶
GHSA
GHSA-jwwf-6j78-h8g4: The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2↗2024-04-09
▶
CVE-2024-1813 — Deserialization of Untrusted Data | cvebase