Paper/Archive/CVE-2024-38773

CVE-2024-38773

Adrian Tobey FormLift for Infusionsoft Web Forms — WordPress formlift plugin <= 7.5.17 - Unauthenticated Blind SQL Injection vulnerability

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 80.6.806 × 2016.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17.

Affected

ProductAffectedFixed inSource

FormLift for Infusionsoft Web Formsn/a – 7.5.17–CNA

formlift_for_infusionsoft_web_forms≤ 7.5.17–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patchstack (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refpatchstack.com/database/vulnerability/formlift/wordpress-formlift-plugin-7-5-17-unauthenticated-blind-sql-injection-vulnerability?_s_id=cve