cve/2024/CVE-2024-5522.md

### [CVE-2024-5522](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5522)
![](https://img.shields.io/static/v1?label=Product&message=HTML5%20Video%20Player%20&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%202.5.27%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brighgreen)

### Description

The HTML5 Video Player  WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

### POC

#### Reference
- https://wpscan.com/vulnerability/bc76ef95-a2a9-4185-8ed9-1059097a506a/

#### Github
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/truonghuuphuc/CVE-2024-5522-Poc