PT-2024-25319 · 8Theme · 8Theme Xstore Core

Rafie Muhammad · Published 2024-04-28 · Updated 2025-02-21 · CVE-2024-33551

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 8theme XStore Core versions from n/a through 5.3.5

Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL injection, potentially enabling access to database commands. A proof of concept (POC) demonstrates the vulnerability using a POST request to the / endpoint with a malicious SQL query. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For 8theme XStore Core versions from n/a through 5.3.5, update to a version later than 5.3.5 to resolve the issue. As a temporary workaround, consider restricting access to the / endpoint to minimize the risk of exploitation. Avoid using user-input data in SQL queries until the issue is resolved. At the moment, there is no additional information about other mitigation measures.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-33551

Affected Products

8Theme Xstore Core

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-33551 · Security Note
• https://osv.dev/vulnerability/CVE-2024-33551 · Vendor Advisory
• https://t.me/cvenotify/112083 · Telegram Post
• https://patchstack.com/database/vulnerability/et-core-plugin/wordpress-xstore-core-plugin-5-3-5-unauthenticated-sql-injection-vulnerability?_s_id=cve · Note
• https://t.me/proxy_bar/2083 · Telegram Post
• https://twitter.com/linuxpatch/status/1784842451850572028 · Twitter Post
• https://t.me/cvenotify/78310 · Telegram Post
• https://twitter.com/CVEnew/status/1784834871330046303 · Twitter Post
• https://twitter.com/cracbot/status/1785246817501815121 · Twitter Post