Vulnerability · Published Nov 8, 2021 · Assigned by WPScan
CVE-2021-24791Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections
High 7.2
In plain English
A high-severity SQL injection in Header Footer Code Manager from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.2% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)7.2High
Exploit odds (30 days)5.2%top 7.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Header Footer Code Manager | 1.1.14 – before 1.1.14 |
Weakness: CWE-89