CVE-2024-8911— WordPress plugin LatePoint SQL注入漏洞
Public Exploits 1
Nuclei · 1 CVE-2024-8911.yaml [template]
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2024-8911の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection
ソース: CVE Program / CVE List V5
脆弱性説明
The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note that changing a WordPress user's password is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. Without this setting enabled, only the passwords of plugin customers, which are stored and managed in a separate database table, can be modified.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
ソース: CVE Program / CVE List V5
脆弱性タイトル
WordPress plugin LatePoint SQL注入漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin LatePoint 5.0.11版本及之前版本存在SQL注入漏洞，该漏洞源于对用户提供的参数转义不足以及对现有SQL查询缺乏足够的准备。攻击者利用该漏洞可以更改用户密码并可能接管管理员帐户。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| latepoint | LatePoint Plugin | * ~ 5.0.11 | - |
II. CVE-2024-8911の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|---|---|---|
| 1 | The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note that changing a WordPress user's password is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. Without this setting enabled, only the passwords of plugin customers, which are stored and managed in a separate database table, can be modified. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8911.yaml | POC詳細 |
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2024-8911のインテリジェンス情報
请登录查看更多情报信息。
CVE-2024-8911 厂商页面 (1)
IV. 関連脆弱性
同じベンダー: latepoint
- CVE-2026-5391
LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cro - CVE-2026-57714
WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerab - CVE-2026-5356
LatePoint - Calendar Booking Plugin for Appointments and Eve - CVE-2026-11398
LatePoint <= 5.6.1 - Missing Authorization to Unauthenticate - CVE-2026-12657
LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object
同じ弱点: CWE-89
- CVE-2026-17111
IBM i is Affected By Multiple Vulnerabilities in SQL - CVE-2026-73332
CamaleonCMS cama_contact_form Plugin Stored XSS via before_h - CVE-2026-72807
SiYuan before v3.7.4 SQL Injection via queryBlocks template - CVE-2026-73331
CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug - CVE-2026-73300
Budibase: SQL Injection via `multipleStatements: true`
V. CVE-2024-8911へのコメント
まだコメントはありません