CVE-2021-4134 Fancy Product Designer <= 4.7.4 Admin+ SQL Injection

What is CVE-2021-4134?

CVE-2021-4134 is a high-severity SQL injection vulnerability in Fancy Product Designer , published on 16 Feb 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.

Weakness: CWE-89

Which versions are affected by CVE-2021-4134?

It affects 1 product.

Products include Radykal Fancy Product Designer.

How do I fix CVE-2021-4134?

No fix has been published for CVE-2021-4134 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2021-4134 being exploited?

There is no known exploitation of CVE-2021-4134 in the wild and no public exploit code.

Other vulnerabilities in Fancy Product Designer

• CVE-2021-24370 Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE Critical 9.8
• CVE-2021-4334 Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options High 8.8
• CVE-2021-4096 Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload High 8.8
• CVE-2024-0365 Fancy Product Designer < 6.1.5 - Admin+ SQL Injection Medium 6.5
• CVE-2024-0905 Fancy Product Designer < 6.1.8 - Reflected Cross Site Scripting Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mp27-fcc3-85qx.