The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in ve
अनुवाद हो रहा है…प्लेटफ़ॉर्म
wordpress
घटक
ultimate-member
में ठीक किया गया
2.8.3
CVE-2024-1071 describes a critical SQL Injection vulnerability affecting the Ultimate Member plugin for WordPress. This flaw allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized data access and manipulation. The vulnerability impacts versions 2.1.3 through 2.8.2 and a patch is available from the vendor. Prompt remediation is essential to protect WordPress sites using this plugin.
इस CVE को अपने प्रोजेक्ट में पहचानें
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।
प्रभाव और हमले की स्थितियाँअनुवाद हो रहा है…
Successful exploitation of CVE-2024-1071 allows an attacker to inject arbitrary SQL code into database queries. This can result in the extraction of sensitive information, including user credentials, personal data, and potentially even administrative details. Depending on the database structure and permissions, an attacker could also modify or delete data, leading to data integrity issues and service disruption. The lack of authentication required for exploitation significantly broadens the attack surface, making WordPress sites using vulnerable versions of the Ultimate Member plugin a prime target for malicious actors. This vulnerability shares similarities with other SQL Injection flaws where attackers can bypass security controls and gain unauthorized access.
शोषण संदर्भअनुवाद हो रहा है…
CVE-2024-1071 was publicly disclosed on March 13, 2024. The vulnerability's critical severity and ease of exploitation suggest a high probability of active scanning and exploitation. Public proof-of-concept exploits are likely to emerge, further increasing the risk. Monitor security advisories and threat intelligence feeds for updates on exploitation campaigns. This CVE is not currently listed on the CISA KEV catalog.
कौन जोखिम में हैअनुवाद हो रहा है…
WordPress websites utilizing the Ultimate Member plugin, particularly those running versions 2.1.3 through 2.8.2, are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially lead to the compromise of others. Sites with sensitive user data or those that rely on the Ultimate Member plugin for critical functionality are also at higher risk.
पहचान के चरणअनुवाद हो रहा है…
• wordpress / composer / npm:
grep -r "sorting=.*(;|--)" /var/log/apache2/access.log• wordpress / composer / npm:
wp plugin list | grep "Ultimate Member"• wordpress / composer / npm:
wp plugin update ultimate-member --all• generic web:
curl -I 'https://your-wordpress-site.com/?s=sorting=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10' हमले की समयरेखा
- Disclosure
disclosure
खतरा खुफिया
एक्सप्लॉइट स्थिति
EPSS
92.91% (100% शतमक)
CISA SSVC
CVSS वेक्टर
इन मेट्रिक्स का क्या मतलब है?
- Attack Vector
- नेटवर्क — इंटरनेट के माध्यम से दूरस्थ रूप से शोषण योग्य। कोई भौतिक या स्थानीय पहुंच आवश्यक नहीं।
- Attack Complexity
- निम्न — कोई विशेष शर्त नहीं। विश्वसनीय रूप से शोषण योग्य।
- Privileges Required
- कोई नहीं — बिना प्रमाणीकरण के शोषण योग्य।
- User Interaction
- कोई नहीं — स्वचालित और मूक हमला। पीड़ित कुछ नहीं करता।
- Scope
- अपरिवर्तित — प्रभाव केवल कमज़ोर घटक तक सीमित।
- Confidentiality
- उच्च — पूर्ण गोपनीयता हानि। हमलावर सभी डेटा पढ़ सकता है।
- Integrity
- उच्च — हमलावर कोई भी डेटा लिख, बदल या हटा सकता है।
- Availability
- उच्च — पूर्ण क्रैश या संसाधन समाप्ति। पूर्ण सेवा से इनकार।
प्रभावित सॉफ्टवेयर
पैकेज जानकारी
- सक्रिय इंस्टॉलेशन
- 200Kलोकप्रिय
- प्लगइन रेटिंग
- 4.4
- WordPress आवश्यक
- 6.2+
- संगत संस्करण तक
- 6.9.4
- PHP आवश्यक
- 7.0+
कमजोरी वर्गीकरण (CWE)
समयरेखा
- आरक्षित
- प्रकाशित
- संशोधित
- EPSS अद्यतन
शमन और वर्कअराउंडअनुवाद हो रहा है…
The primary mitigation for CVE-2024-1071 is to immediately upgrade the Ultimate Member plugin to a patched version. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting access to the affected endpoint, implementing stricter input validation on the 'sorting' parameter, or using a Web Application Firewall (WAF) to filter out malicious SQL injection attempts. Monitor WordPress access logs for suspicious SQL queries targeting the plugin. After upgrading, confirm the fix by attempting to inject a simple SQL query through the 'sorting' parameter and verifying that it is properly sanitized.
कैसे ठीक करेंअनुवाद हो रहा है…
Actualice el plugin Ultimate Member a la última versión disponible. Esto solucionará la vulnerabilidad de inyección SQL. Si no puede actualizar de inmediato, considere deshabilitar el plugin temporalmente.
CVE सुरक्षा न्यूज़लेटर
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
अक्सर पूछे जाने वाले सवालअनुवाद हो रहा है…
What is CVE-2024-1071 — SQL Injection in Ultimate Member Plugin?
CVE-2024-1071 is a critical SQL Injection vulnerability in the Ultimate Member WordPress plugin, allowing attackers to extract data via the 'sorting' parameter.
Am I affected by CVE-2024-1071 in Ultimate Member Plugin?
You are affected if your WordPress site uses the Ultimate Member plugin versions 2.1.3 through 2.8.2. Check your plugin versions immediately.
How do I fix CVE-2024-1071 in Ultimate Member Plugin?
Upgrade the Ultimate Member plugin to the latest available version. If immediate upgrade is not possible, implement temporary workarounds like WAF rules or input validation.
Is CVE-2024-1071 being actively exploited?
Due to its critical severity and ease of exploitation, it is highly probable that CVE-2024-1071 is being actively scanned and exploited.
Where can I find the official Ultimate Member advisory for CVE-2024-1071?
Refer to the official Ultimate Member website and WordPress plugin repository for the latest security advisory and patch information.
क्या आपका प्रोजेक्ट प्रभावित है?
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।