CVE-2024-5522
Published: 20 June 2024
Summary
CVE-2024-5522 is a medium-severity SQL Injection (CWE-89) vulnerability in Bplugins Html5 Video Player. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The HTML5 Video Player WordPress plugin before version 2.5.27 contains a SQL injection vulnerability (CWE-89) because it fails to sanitize and escape a parameter received via a REST route before incorporating it into a SQL statement. The affected component is this plugin running on WordPress sites, and the flaw carries a CVSS 3.1 score of 6.5 with a network attack vector, no authentication or user interaction required, and limited impacts to confidentiality and integrity.
Unauthenticated attackers can send crafted requests to the exposed REST endpoint and execute arbitrary SQL queries against the database. Successful exploitation allows reading or modifying selected data within the application's database scope without needing credentials.
The referenced WPScan advisory identifies the issue in versions prior to 2.5.27 and indicates that updating the plugin closes the exposure. The associated EPSS score stands at 0.8384 with no reported rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-46726
Vulnerability details
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.