CVE-2024-30499 WordPress CRM Perks Forms plugin <= 1.1.4 - SQL Injection vulnerability
Attackers can execute arbitrary SQL commands via the CRM Perks Forms plugin, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-30499?
CVE-2024-30499 is a high-severity SQL injection vulnerability in CRM Perks Forms, published on 29 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.
Weakness: CWE-89
Which versions are affected by CVE-2024-30499?
It affects 1 product.
Products include Crmperks Crm Perks Forms.
How do I fix CVE-2024-30499?
No fix has been published for CVE-2024-30499 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-30499 being exploited?
There is no known exploitation of CVE-2024-30499 in the wild and no public exploit code.
Other vulnerabilities in CRM Perks Forms
- CVE-2024-30498 WordPress CRM Perks Forms plugin <= 1.1.4 - Unauthenticated SQL Injection vulnerability
- CVE-2024-7484 CRM Perks Forms <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2024-30446 WordPress CRM Perks Forms plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2022-38467 WordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2023-51536 WordPress CRM Perks Forms Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-5jvh-2rg4-779c.