CVE-2024-43917

published 2024-08-29

CVE-2024-43917: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL…

Priority P1 87 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV Initial access

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injection.This issue affects TI WooCommerce Wishlist: from n/a through 2.8.2.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
templateinvaders	ti_woocommerce_wishlist	<= 2.8.2	—
templateinvaders	ti_woocommerce_wishlist	n/a – 2.8.2	—

Detection & IOCs extracted from sources · hover to see the quote

url /wp-admin/admin-ajax.php↗

sigma

title: WordPress TI WooCommerce Wishlist SQLi
condition: contains(uri, 'admin-ajax.php') and contains(content_type, 'application/json') and contains(body, 'product_id')

• → The vulnerability is unauthenticated, so no session/auth cookie is required — monitor for SQLi payloads in requests to admin-ajax.php containing 'product_id' in a JSON body. ↗
• → Detection rule targets HTTP requests where content-type is 'application/json' AND the body contains the string 'product_id', correlated with the WordPress AJAX endpoint.
• → A Metasploit auxiliary scanner module exists for this CVE, meaning automated exploitation is trivial; prioritize detection of scanner-style repeated AJAX requests. ↗

• · Vulnerability affects TI WooCommerce Wishlist versions up to and including 2.8.2 only; versions above 2.8.2 are not affected. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.3 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89