The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/52c8755c-46b9-4383-8c8d-8816f03456b0 | Exploit Third Party Advisory |
Configurations
History
26 Aug 2021, 18:58
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:quantumcloud:slider_hero:*:*:*:*:*:wordpress:*:* | |
CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 8.8 |
References | (MISC) https://wpscan.com/vulnerability/52c8755c-46b9-4383-8c8d-8816f03456b0 - Exploit, Third Party Advisory |
23 Aug 2021, 12:23
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-08-23 12:15
Updated : 2024-02-04 21:47
NVD link : CVE-2021-24506
Mitre link : CVE-2021-24506
CVE.ORG link : CVE-2021-24506
JSON object : View
Products Affected
quantumcloud
- slider_hero
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')