Exploit for SQL Injection in Internet-Formation Wp-Advanced-Search

CVE-2024-9796

githubexploit · 2026-01-25

Description

Exploit for SQL injection in Internet-Formation WP Advanced-Search plugin; includes proof of concept.

Entry point

Parameterf · query param

Pathwp-content/plugins/wp-advanced-search/class.inc/autocompletion/autocompletion-PHP5.5.php

Unauthenticated SQL injection via unsanitized t parameter used in SQL statement (CWE-89).

Affected Internet-formation Wp-advanced-search versions

Internet-formation Wp-advanced-search< 3.3.9.2

All known vulnerabilities by product

Wp-Advanced-Search

CVSS 9.8 for CVE-2024-9796

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:LOCAL

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:LOW

Integrity:LOW

Availability:LOW

Working code

33%confidence this exploit runs

Based on 1 file(s) in the source

EPSS Score

3.0%higher than 86.2% of all CVEs

Updated 2026-08-17

Exploit Details

Modified:2026-01-25 22:47

Last Seen:2026-01-25 22:58

Reporter:yup-Ivan

Written in:Python

Last commit:2026-01-25

Other exploits for CVE-2024-9796

CVE-2024-9796

2026-09-11 KitPloitKITPLOIT

CVE-2024-9796

2026-09-09 KitPloitKITPLOIT

CVE-2024-9796

2026-09-07 KitPloitKITPLOIT

CVE-2024-9796

2026-09-07 KitPloitKITPLOIT

Exploit for SQL Injection in Internet-Formation Wp-Advanced-Search

2025-06-20 BwithEGITHUB

Exploit for SQL Injection in Internet-Formation Wp-Advanced-Search

2024-10-18 RandomRobbieBFGITHUB

Exploit Code

README3 lines

## https://sploitus.com/exploit?id=8E143CAC-BA90-5D0F-BDDC-01D66997FC12
# CVE-2024-9796
POC (SQLi) -> CVE-2024-9796

Exploit Code

Share

Share on social media: