wpDataTables < 3.4.2 - Blind SQL Injection via start Parameter
CVE-2021-24199
6.5MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 12 April 2021
What is CVE-2021-24199?
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
Affected Version(s)
wpDataTables – Tables & Table Charts 3.4.2