CVE-2024-1061
Published: 30 January 2024
Summary
CVE-2024-1061 is a high-severity SQL Injection (CWE-89) vulnerability in Bplugins Html5 Video Player. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The HTML5 Video Player WordPress plugin versions prior to 2.5.25 are affected by an unauthenticated SQL injection vulnerability (CWE-89) in the 'id' parameter of the get_view function. The flaw carries a CVSS 3.1 score of 8.6 with network attack vector, low complexity, no required privileges or user interaction, and changed scope that yields high confidentiality impact.
An unauthenticated remote attacker can supply crafted input to the vulnerable parameter and extract sensitive information from the underlying database. Successful exploitation does not require authentication or user interaction and can affect resources beyond the plugin itself.
Public advisories from Tenable reference TRA-2024-02 and provide further technical details on the issue. The associated EPSS score has reached a peak of 0.8449 with a current value of 0.8337, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-16836
Vulnerability details
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.