CVE-2024-6338 FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter
Authenticated subscribers can exploit SQL injection in the FV Flowplayer plugin to extract sensitive database information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6338?
CVE-2024-6338 is a high-severity SQL injection vulnerability in foliovision FV Flowplayer Video Player, published on 19 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Weakness: CWE-89
Which versions are affected by CVE-2024-6338?
It affects 1 product.
Products include Foliovision Fv Flowplayer Video Player.
How do I fix CVE-2024-6338?
No fix has been published for CVE-2024-6338 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-6338 being exploited?
There is no known exploitation of CVE-2024-6338 in the wild and no public exploit code.
Other vulnerabilities in foliovision FV Flowplayer Video Player
- CVE-2019-14801 SQL injection in n/a
- CVE-2019-13573 SQL injection in n/a
- CVE-2023-30499 WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)
- CVE-2022-25607 WordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerability
- CVE-2021-39350 FV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site Scripting
Sources
Also known as GHSA-wgpq-79rc-3fgg.