title: Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection
description: The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.
problem types: CWE-89 SQL Injection
affected:
{
product: Car Seller - Auto Classifieds Script
vendor: Unknown
versions:
lessThanOrEqual: 2.1.0, status: affected, version: 2.1.0, versionType: custom
}