Vulnerability · Published Jul 6, 2021 · Assigned by WPScan

CVE-2021-24384JoomSport < 5.1.8 - Unauthenticated PHP Object Injection

Critical 9.8

In plain English

A critical-severity unsafe deserialization in JoomSport – for Sports: Team & League, Football, Hockey & more from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)2.1%top 18.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget chain to exploit this, other installed plugins could, which might lead to more severe issues such as RCE

Affected products (as reported)

Vendor	Product	Versions
Unknown	JoomSport – for Sports: Team & League, Football, Hockey & more	5.1.8 – before 5.1.8

Weakness: CWE-502

References

https://wpscan.com/vulnerability/fb6c407c-713c-4e83-92ce-4e5f791be696 x_refsource_CONFIRM