This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: SQL Injection (SQLi) in 'Car Seller - Auto Classifieds Script' WP plugin. 💥 **Consequences**: Attackers can manipulate SQL queries via the `order_id` POST parameter.…
🛡️ **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command. 🔍 **Flaw**: The plugin fails to sanitize, validate, or escape the `order_id` parameter before injecting it into SQL statements.…
📦 **Product**: Car Seller - Auto Classifieds Script WordPress Plugin. 📅 **Affected Versions**: Version 2.1.0 and all previous versions. 🏢 **Vendor**: Unknown.
Q4What can hackers do? (Privileges/Data)
🕵️ **Privileges**: Exploitable by both **Authenticated** and **Unauthenticated** users. 💾 **Data Impact**: Full SQL injection capabilities.…
⚡ **Threshold**: LOW. 🚪 **Auth**: No authentication required! The vulnerability exists in the `request_list_request` AJAX call, accessible to anyone visiting the site. This makes it extremely easy to exploit.
Q6Is there a public Exp? (PoC/Wild Exploitation)
🔓 **Public Exp?**: YES. 📄 **PoC**: Available via Nuclei templates (projectdiscovery/nuclei-templates).…
🩹 **Fix**: Update the plugin to a version newer than 2.1.0. 📢 **Official Patch**: The vendor should release a patched version. Until then, refer to the vendor's disclosure links for updates.…
🔥 **Urgency**: HIGH. 🚨 **Priority**: Critical. Since it affects unauthenticated users and has public PoCs, immediate action is required. Patch or disable the plugin ASAP to prevent data breaches.