CVE-2024-9130: GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, that can be used to extract sensitive information from the database.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9130?
CVE-2024-9130 is considered a high severity vulnerability due to its potential for time-based SQL injection attacks.
How do I fix CVE-2024-9130?
To fix CVE-2024-9130, update the GiveWP plugin to version 3.16.2 or later.
What versions of GiveWP are affected by CVE-2024-9130?
All versions of the GiveWP plugin up to and including 3.16.1 are affected by CVE-2024-9130.
What type of vulnerability is CVE-2024-9130?
CVE-2024-9130 is a time-based SQL injection vulnerability.
Can CVE-2024-9130 lead to data exposure?
Yes, CVE-2024-9130 can potentially lead to unauthorized data exposure through SQL injection.