WordPress Ni CRM Lead plugin <= 1.3.0 - SQL Injection vulnerability
CVE-2024-54258

8.5HIGH

Key Information:

Vendor
WordPress
Status
Ni Crm Lead
Vendor
CVE Published:
13 December 2024

Summary

An SQL Injection vulnerability exists in Ni CRM Lead, an application developed by Anzia. This vulnerability occurs due to improper neutralization of special elements used in SQL commands, allowing attackers to execute arbitrary SQL queries. The issue impacts all versions up to and including 1.3.0. Exploitation of this flaw may result in unauthorized access to sensitive data, manipulation of the database, or complete compromise of the application. Organizations using affected versions are advised to implement mitigations and update to the latest available version.

Affected Version(s)

Ni CRM Lead <= 1.3.0

References

https://patchstack.com/database/wordpress/plugin/ni-crm-l...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

thiennv (Patchstack Alliance)
.