CVE-2021-24384
JoomSport < 5.1.8 - Unauthenticated PHP Object Injection
- State
- Published
- Severity
- Not scored
- Published
- Jul 6, 2021
- Updated
- Aug 3, 2024
- Reserved
- Jan 14, 2021
Description
The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget chain to exploit this, other installed plugins could, which might lead to more severe issues such as RCE
Scores
The record has no CVSS score.
Weaknesses
- CWE-502 Deserialization of Untrusted Data
Affected Products
| Product | Versions |
|---|---|
JoomSport – for Sports: Team & League, Football, Hockey & moreUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.