CVE-2024-1061
HTML5 Video Player <= 2.5.24 - Unauthenticated SQL Injection via id
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function.
El complemento de WordPress 'HTML5 Video Player', versión <2.5.25, se ve afectado por una vulnerabilidad de inyección SQL no autenticada en el parámetro 'id' de la función 'get_view'.
The Html5 Video Player plugin for WordPress is vulnerable to SQL Injection via the 'id’ parameter in all versions up to, and including, 2.5.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-01-30 CVE Reserved
- 2024-01-30 CVE Published
- 2024-11-12 CVE Updated
- 2024-11-12 First Exploit
- 2024-11-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
- CAPEC-66: SQL Injection
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://www.tenable.com/security/research/tra-2024-02 | 2024-11-12 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Bplugins Search vendor "Bplugins" | Html5 Video Player Search vendor "Bplugins" for product "Html5 Video Player" | < 2.5.25 Search vendor "Bplugins" for product "Html5 Video Player" and version " < 2.5.25" | wordpress |
Affected
|