PT-2024-36495 · WordPress · Html5 Video Player

Coldfusionx + 1 · Published 2024-05-31 · Updated 2024-11-06 · CVE-2024-5522

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HTML5 Video Player WordPress plugin versions prior to 2.5.27

Description The issue concerns a failure to sanitize and escape a parameter from a REST route before using it in a SQL statement. This allows unauthenticated users to perform SQL injection attacks. The vulnerable API endpoint is "/wp-json/h5vp/v1/video/0" with the id parameter being used in the SQL statement. An example of exploitation is provided using the GET method with a crafted id parameter.

Recommendations For versions prior to 2.5.27, update to version 2.5.27 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoint "/wp-json/h5vp/v1/video/0" until the update is applied. Avoid using the id parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-5522

Affected Products

Html5 Video Player

References · 13

• 🔥 https://github.com/geniuszly/CVE-2024-5522 · Exploit
• 🔥 https://github.com/geniuszlyy/CVE-2024-5522 · Exploit
• 🔥 https://wpscan.com/vulnerability/bc76ef95-a2a9-4185-8ed9-1059097a506a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-5522 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5522 · Vendor Advisory
• https://t.me/securixy_kz/914 · Telegram Post
• https://t.me/cvenotify/83815 · Telegram Post
• https://t.me/pentestingnews/47582 · Telegram Post
• https://t.me/pentestbacklog/370 · Telegram Post
• https://t.me/proxy_bar/2163 · Telegram Post
• https://twitter.com/ColdFusionX_/status/1797922577819848959 · Twitter Post
• https://twitter.com/HackingTeam777/status/1854044575742017968 · Twitter Post
• https://twitter.com/CVEnew/status/1803703993300033811 · Twitter Post