PT-2024-38314 · WordPress · Wordpress Simple Html Sitemap

Anhchangmutrang + 1 · Published 2024-09-24 · Updated 2024-10-02 · CVE-2024-7385

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress Simple HTML Sitemap plugin versions up to 3.1

Description The issue allows authenticated attackers with Administrator-level access and above to append additional SQL queries into existing queries, potentially extracting sensitive information from the database. This is due to insufficient escaping on the user-supplied id parameter and lack of sufficient preparation on the existing SQL query.

Recommendations For versions up to 3.1, as a temporary workaround, consider restricting access to the id parameter in the affected API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-7385

Affected Products

Wordpress Simple Html Sitemap

References · 13

• https://plugins.trac.wordpress.org/changeset/3155037/wp-simple-html-sitemap/trunk/inc/wshs_saved.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-7385 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7385 · Vendor Advisory
• https://twitter.com/CVEnew/status/1838785197631762721 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1838815703018696986 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-simple-html-sitemap/tags/3.1/inc/wshs_saved.php#L47 · Note
• https://t.me/cvenotify/95893 · Telegram Post
• https://t.me/cvedetector/6286 · Telegram Post
• https://t.me/cvenotify/96861 · Telegram Post
• https://twitter.com/AegisLens/status/1839289327693520921 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f529b981-623f-4bd3-9155-ebfab4c65d1d?source=cve · Note
• https://t.me/latest_high_impact_cve/1208 · Telegram Post
• https://twitter.com/CveFindCom/status/1838791008902840687 · Twitter Post