Description
The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Car Seller - Auto Classifieds Script | 2.1.0 – ≤ 2.1.0 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Car Seller - Auto Classifieds Script - SQL Injection http/cves/2021/CVE-2021-24285.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.