SQL Injection Vulnerability in Library Management System
CVE-2024-8679

6.8MEDIUM

Key Information:

Vendor

Wordpress
Vendor
CVE Published:
7 December 2024

What is CVE-2024-8679?

The Library Management System – Manage e-Digital Books Library plugin for WordPress is susceptible to SQL Injection attacks through the ‘value' parameter of the owt_lib_handler AJAX action. This vulnerability arises from inadequate escaping of user-supplied parameters and insufficient preparation of the SQL query. Authenticated attackers with Administrator-level access can exploit this flaw, enabling them to append additional SQL queries to existing ones. This manipulation opens avenues for extracting sensitive information from the database, potentially compromising the integrity and confidentiality of user data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://plugins.trac.wordpress.org/browser/library-manage...
https://www.wordfence.com/threat-intel/vulnerabilities/id...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.