← Back to CVEs

CVE-2024-36082

MEDIUM

6.5

Description

SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitrary SQL commands. Information stored in the database may be obtained or altered by the attacker.

CVE Details

CVSS v3.1 Score6.5

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published6/7/2024

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

codepeople:music_store

Weaknesses (CWE)

CWE-89CWE-89

References

https://jvn.jp/en/jp/JVN79213252/(vultures@jpcert.or.jp)

https://plugins.trac.wordpress.org/changeset?new=3085975%40music-store%2Ftrunk%2Fmusic-store.php&old=3079647%40music-store%2Ftrunk%2Fmusic-store.php(vultures@jpcert.or.jp)

https://wordpress.org/plugins/music-store/(vultures@jpcert.or.jp)

https://jvn.jp/en/jp/JVN79213252/(af854a3a-2127-422b-91ae-364da2661108)

https://plugins.trac.wordpress.org/changeset?new=3085975%40music-store%2Ftrunk%2Fmusic-store.php&old=3079647%40music-store%2Ftrunk%2Fmusic-store.php(af854a3a-2127-422b-91ae-364da2661108)

https://wordpress.org/plugins/music-store/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.