CVE-2021-24398
Assigner: WPScan
Published: 2021-09-20T10:06:02
State: PUBLISHED
affected: product: RESPONSIVE 3D SLIDER
vendor: Unknown
versions: lessThanOrEqual: 1.2
status: affected
version: 1.2
versionType: custom
credits: value: Syed Sheeraz Ali of Codevigilant
descriptions: value: The Add new scene functionality in the Responsive 3D Slider WordPress plugin through 1.2 uses an id parameter which is not sanitised, escaped or validated before being inserted to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query is ran twice.
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 SQL Injection
type: CWE
source: discovery: UNKNOWN
title: Responsive 3D Slider <= 1.2 - Authenticated SQL Injection
x_generator: WPScan CVE Generator