CVE-2024-43144

published 2024-08-29

CVE-2024-43144: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Cost Calculator Builder allows SQL…

Priority P2 67 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Cost Calculator Builder allows SQL Injection.This issue affects Cost Calculator Builder: from n/a through 3.2.15.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
stylemixthemes	cost_calculator_builder	< 3.2.16	3.2.16
stylemixthemes	cost_calculator_builder	n/a – 3.2.15	—

Detection & IOCs extracted from sources · hover to see the quote

version Cost Calculator Builder <= 3.2.15↗

• → Detect SQL injection attempts targeting the Cost Calculator Builder WordPress plugin (versions up to and including 3.2.15) by monitoring for unsanitized SQL special characters (e.g., single quotes, comparison operators) in plugin-related HTTP requests. ↗
• → The nuclei-style rule signature references a payload pattern 'Cost Calculator Builder =8\'' suggesting SQL injection probe strings with comparison operators and quote characters should be flagged in WAF/IDS rules for this plugin's endpoints.

• · The vulnerability affects all versions of Cost Calculator Builder from the beginning (n/a) through 3.2.15; no lower bound version is specified, so all installations should be treated as affected until patched. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89