SQL Injection Vulnerability in Library Management System
CVE-2024-8679

6.8MEDIUM

Key Information:

Vendor
Wordpress
Vendor
CVE Published:
7 December 2024

Summary

The Library Management System – Manage e-Digital Books Library plugin for WordPress is susceptible to SQL Injection attacks through the ‘value' parameter of the owt_lib_handler AJAX action. This vulnerability arises from inadequate escaping of user-supplied parameters and insufficient preparation of the SQL query. Authenticated attackers with Administrator-level access can exploit this flaw, enabling them to append additional SQL queries to existing ones. This manipulation opens avenues for extracting sensitive information from the database, potentially compromising the integrity and confidentiality of user data.

References

https://plugins.trac.wordpress.org/browser/library-manage...
https://www.wordfence.com/threat-intel/vulnerabilities/id...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.