Time-Based SQL Injection Vulnerability in FV Flowplayer Video Player

CVE-2024-6338

What is CVE-2024-6338?

The FV Flowplayer Video Player plugin for WordPress is susceptible to a time-based SQL Injection vulnerability. This issue exists due to improper handling of the ‘exclude’ parameter, where the lack of sufficient escaping on user-supplied data allows attackers with Subscriber-level access or higher to inject additional SQL queries. This exploitation could lead to unauthorized access and extraction of sensitive data from the database, posing a significant risk to affected WordPress installations. It is imperative for site administrators to update to the latest plugin version to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References