Parcel Panel SQL Injection Vulnerability
CVE-2024-34412

8.5HIGH

Key Information:

Vendor
WordPress
Status
Parcelpanel
Vendor
CVE Published:
6 May 2024

Summary

The vulnerability in Parcel Panel is characterized by the improper neutralization of special elements used in SQL commands, leading to a potential SQL injection. This type of vulnerability can allow attackers to interfere with the queries that an application makes to its database. If exploited, this could enable unauthorized access to sensitive data or allow for malicious code execution. Users of ParcelPanel Plugin versions from n/a up to 3.8.1 are urged to take immediate action to mitigate the risk.

Affected Version(s)

ParcelPanel <= 3.8.1

References

https://patchstack.com/database/vulnerability/parcelpanel...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Le Ngoc Anh (Patchstack Alliance)
.