The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget chain to exploit this, other installed plugins could, which might lead to more severe issues such as RCE
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/fb6c407c-713c-4e83-92ce-4e5f791be696 | Exploit Third Party Advisory |
https://wpscan.com/vulnerability/fb6c407c-713c-4e83-92ce-4e5f791be696 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 05:52
Type | Values Removed | Values Added |
---|---|---|
References | () https://wpscan.com/vulnerability/fb6c407c-713c-4e83-92ce-4e5f791be696 - Exploit, Third Party Advisory |
09 Jul 2021, 11:38
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
CPE | cpe:2.3:a:beardev:joomsport:*:*:*:*:*:wordpress:*:* | |
CWE | CWE-502 | |
References | (CONFIRM) https://wpscan.com/vulnerability/fb6c407c-713c-4e83-92ce-4e5f791be696 - Exploit, Third Party Advisory |
06 Jul 2021, 11:25
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-07-06 11:15
Updated : 2024-11-21 05:52
NVD link : CVE-2021-24384
Mitre link : CVE-2021-24384
CVE.ORG link : CVE-2021-24384
JSON object : View
Products Affected
beardev
- joomsport
CWE
CWE-502
Deserialization of Untrusted Data