CVE-2021-24285
Critical
Description
The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.
SeverityCritical
CVSS9.8
Exploit probability—
ProductCars-seller-auto-classifieds-script
PublishedMay 14, 2021
First seenMay 14, 2021
Weakness typeCWE-89SQL injection
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cars-seller-auto-classifieds-script_project cars-seller-auto-classifieds-script | v ≤ 2.1.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.