CVE-2024-51818
Published: 21 January 2025
Summary
CVE-2024-51818 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SQL injection in Fancy Product Designer by requiring validation and sanitization of untrusted inputs used in SQL commands.
Ensures timely patching of the specific SQL injection flaw (CVE-2024-51818) in the Fancy Product Designer WordPress plugin versions <=6.4.3.
Vulnerability scanning identifies the unauthenticated SQL injection vulnerability in the plugin, enabling proactive remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in public-facing WordPress plugin directly enables remote exploitation of web apps (T1190) for unauthorized database data extraction (T1213.006).
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.
Deeper analysisAI
CVE-2024-51818 is an Improper Neutralization of Special Elements used in an SQL Command, known as an SQL Injection vulnerability (CWE-89), affecting the Fancy Product Designer WordPress plugin developed by radykal under the fancy-product-designer component. This issue impacts all versions from n/a through 6.4.3. The vulnerability carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and potential for scope change with high confidentiality impact.
Unauthenticated remote attackers can exploit this vulnerability over the network without privileges or user interaction. Successful exploitation enables high confidentiality impact, such as unauthorized extraction of sensitive data from the database, alongside low availability disruption, while integrity remains unaffected.
The Patchstack advisory at the provided reference URL documents this unauthenticated SQL injection vulnerability specifically in Fancy Product Designer plugin version 6.4.3 for WordPress and offers details on mitigation strategies.
Details
- CWE(s)