cve/2021/CVE-2021-4134.md

### [CVE-2021-4134](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4134)
![](https://img.shields.io/static/v1?label=Product&message=Fancy%20Product%20Designer%20&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=4.7.4%3C%3D%204.7.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brighgreen)

### Description

The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ExpLangcn/FuYao-Go