FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

CVE-2024-9475

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published: Oct 26, 2024 / Updated: 25d ago

010
CVSS 4.9EPSS 0.05%Medium
CVE info copied to clipboard

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9475. See article

Oct 26, 2024 at 2:25 AM / CVE
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 26, 2024 at 2:26 AM
CVE Assignment

NVD published the first details for CVE-2024-9475

Oct 26, 2024 at 3:15 AM
CVSS

A CVSS base score of 4.9 has been assigned.

Oct 26, 2024 at 3:20 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 19.1%)

Oct 26, 2024 at 9:53 AM
Static CVE Timeline Graph

Affected Systems

Wordpress/wordpress
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

News

CVE Alert: CVE-2024-9475 - https://www.redpacketsecurity.com/cve_alert_cve-2024-9475/ #OSINT #ThreatIntel #CyberSecurity #cve_2024_9475
RedPacket Security / @RedPacketSec / 23d
CVE Alert: CVE-2024-9475 - redpacketsecurity.com/cve_al… #OSINT #ThreatIntel #CyberSecurity #cve_2024_9475
RedPacket Security / 23d
CVE Alert: CVE-2024-9475 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-9475/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_9475
Update Sun Oct 27 14:34:00 UTC 2024
Recent Commits to cve:main / 23d
Update Sun Oct 27 14:34:00 UTC 2024
CVE-2024-9475
Updated CVEs from Tenable / 24d
Medium Severity Description The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Read more at https://www.tenable.com/cve/CVE-2024-9475
Medium - CVE-2024-9475 - The Poll Maker – Versus Polls, Anonymous Polls,...
Security-Database Alerts Monitor : Last 100 Alerts / 24d
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versions up to, and including, 5.4.6 due...
See 8 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:High
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:None
Availability Impact:None

Categories

CVSS 4.9(21798)CWE-89(13175)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial