PT-2021-15824 · WordPress · Car Seller - Auto Classifieds Script

Shreya Pohekar · Published 2021-05-14 · Updated 2021-05-21 · CVE-2021-24285

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Car Seller - Auto Classifieds Script WordPress plugin versions 2.1.0 and earlier

Description The issue arises from the request list request AJAX call in the Car Seller - Auto Classifieds Script WordPress plugin, which is accessible to both authenticated and unauthenticated users. This call does not properly sanitise, validate, or escape the order id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.

Recommendations For Car Seller - Auto Classifieds Script WordPress plugin versions 2.1.0 and earlier, update to a version that addresses the SQL Injection issue in the request list request AJAX call. As a temporary workaround, consider restricting access to the request list request AJAX call to prevent potential exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24285

Affected Products

Car Seller - Auto Classifieds Script

References · 5

• 🔥 https://codevigilant.com/disclosure/2021/24-04-2021-wp-plugin-cars-seller-auto-classifieds-script-sql-injection · Exploit
• 🔥 https://wpscan.com/vulnerability/f35d6ab7-dd52-48b3-a79c-3f89edf24162 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24285 · Security Note
• https://t.me/cvenotify/14431 · Telegram Post