CVE-2021-24199
Assigner: WPScan
Published: 2021-04-12T13:59:17
State: PUBLISHED
affected: product: wpDataTables – Tables & Table Charts
vendor: wpDataTables
versions: lessThan: 3.4.2
status: affected
version: 3.4.2
versionType: custom
credits: value: Veno Eivazian, Massimiliano Ferraresi
descriptions: value: The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 SQL Injection
type: CWE
source: discovery: UNKNOWN
title: wpDataTables < 3.4.2 - Blind SQL Injection via start Parameter
x_generator: WPScan CVE Generator