CVE-2024-8855
Published: 07 January 2025
Summary
CVE-2024-8855 is a critical-severity SQL Injection (CWE-89) vulnerability in Wpmarka Wordpress Auction. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires input validation, sanitization, and escaping of parameters before use in SQL statements, comprehensively preventing the SQL injection vulnerability in the WordPress Auction Plugin.
Mandates timely identification, reporting, and remediation of flaws like the unsanitized SQL parameter in CVE-2024-8855 through plugin updates or patches.
Enables detection of the SQL injection vulnerability via regular scanning of the WordPress system and plugins, facilitating proactive remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct SQL injection in public-facing WordPress plugin enables remote exploitation of web application (T1190).
NVD Description
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks
Deeper analysisAI
CVE-2024-8855 is a SQL injection vulnerability (CWE-89) affecting the WordPress Auction Plugin for WordPress through version 3.7. The plugin fails to sanitize and escape a parameter before incorporating it into a SQL statement, enabling injection attacks. It received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with network accessibility, low attack complexity, and potential for high impacts on confidentiality, integrity, and availability.
The vulnerability allows editors and above to perform SQL injection attacks. Despite the description specifying authenticated users at editor level or higher, the CVSS vector assesses it as exploitable with no privileges required (PR:N), suggesting remote attackers could potentially execute arbitrary SQL queries over the network without user interaction.
For mitigation details, refer to the WPScan advisory at https://wpscan.com/vulnerability/04084f2a-45b8-4249-a472-f156fad0c90a/.
Details
- CWE(s)