Exploit
CVE-2024-9796

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published: Oct 10, 2024 / Updated: 40d ago

010
CVSS 9.8EPSS 0.04%Critical
CVE info copied to clipboard

Summary

The WP-Advanced-Search WordPress plugin before version 3.3.9.2 contains a vulnerability where it does not sanitize and escape the 't' parameter before using it in a SQL statement. This allows unauthenticated users to perform SQL injection attacks.

Impact

This vulnerability could allow unauthenticated attackers to perform SQL injection attacks. Such attacks might result in unauthorized access to the database, potential data theft, manipulation of database contents, or even deletion of data. The impact is categorized as LOW for confidentiality, integrity, and availability, suggesting that while the vulnerability is serious, its potential for severe damage is somewhat limited.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability has been addressed in version 3.3.9.2 of the WP-Advanced-Search WordPress plugin. Users should update to this version or later to mitigate the risk.

Mitigation

1. Update the WP-Advanced-Search WordPress plugin to version 3.3.9.2 or later immediately. 2. If immediate updating is not possible, consider temporarily disabling the WP-Advanced-Search plugin until the update can be applied. 3. Implement strong input validation and sanitization practices for all user inputs, especially those used in database queries. 4. Regularly update all WordPress plugins and themes to their latest versions to ensure all known vulnerabilities are patched. 5. Implement the principle of least privilege for database users associated with the WordPress installation. 6. Use Web Application Firewalls (WAF) to help detect and block SQL injection attempts. 7. Regularly backup your WordPress database and files to ensure quick recovery in case of a successful attack.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-9796

Oct 10, 2024 at 8:15 AM
First Article

Feedly found the first article mentioning CVE-2024-9796. See article

Oct 10, 2024 at 8:18 AM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 10, 2024 at 8:18 AM
CVSS

A CVSS base score of 5.9 has been assigned.

Oct 10, 2024 at 3:40 PM / nvd
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.7%)

Oct 11, 2024 at 10:19 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 15, 2024 at 6:50 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Oct 15, 2024 at 9:10 PM
Static CVE Timeline Graph

Affected Systems

Internet-formation/wp-advanced-search
+null more

Exploits

https://wpscan.com/vulnerability/2ddd6839-6bcb-4bb8-97e0-1516b8c2b99b/
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI