Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection
45Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 15%
from disclosure to weapon
Published on NVDMay 14
VulnCheck+983d
exploitation probability
15%top 4% of all CVEs
observed exploitation
yesVulnCheck
The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.
Affected products
Unknown · Car Seller - Auto Classifieds Script