Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2024-3552

CWE-89 — SQL Injection4 documents4 sources
Severity
9.8CRITICAL
EPSS
93.3%
top 0.19%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Unknown WEB Directory FreeSalephpscripts WEB Directory Free
Timeline
PublishedJun 13

Description

The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5unknown/web_directory_free< 1.7.0

🔴Vulnerability Details

2
GHSA
GHSA-jwg5-qqgr-9462: The Web Directory Free WordPress plugin before 1↗2024-06-13
▶
CVEList
Web Directory Free < 1.7.0 - Unauthenticated SQL Injection↗2024-06-13
▶

💥Exploits & PoCs

1
Nuclei
Web Directory Free < 1.7.0 - SQL Injection
▶