Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JoomSport < 5.1.8 - Unauthenticated PHP Object Injection
Vulnerability Description
The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget chain to exploit this, other installed plugins could, which might lead to more severe issues such as RCE
CVSS Information
N/A
Vulnerability Type
可信数据的反序列化
Vulnerability Title
WordPress 插件 代码问题漏洞
Vulnerability Description
WordPress 插件是WordPress开源的一个应用插件。 WordPress的JoomSport 存在代码问题漏洞，该漏洞源于joomsport版本在5.1.8之前，注册了未经认证和未经认证的用户，未序列化的用户输入从shattr POST参数，导致PHP对象注入问题。攻击者可利用该漏洞导致更严重的RCE问题。
CVSS Information
N/A
Vulnerability Type
N/A