1## autogenerated on 2026-02-18 14:28:33
2name: crowdsecurity/vpatch-CVE-2024-8911
3description: 'Detects SQL injection in LatePoint WordPress plugin via password_reset_token parameter in admin-ajax.php.'
4rules:
5  - and:
6      - zones:
7          - URI
8        transform:
9          - lowercase
10        match:
11          type: contains
12          value: /wp-admin/admin-ajax.php
13      - zones:
14          - BODY_ARGS
15        variables:
16          - action
17        transform:
18          - urldecode
19          - lowercase
20        match:
21          type: contains
22          value: latepoint_route_call
23      - zones:
24          - BODY_ARGS
25        variables:
26          - params
27        transform:
28          - urldecode
29          - lowercase
30        match:
31          type: contains
32          value: password_reset_token
33      - zones:
34          - BODY_ARGS
35        variables:
36          - params
37        transform:
38          - urldecode
39          - lowercase
40        match:
41          type: contains
42          value: ;
43
44labels:
45  type: exploit
46  service: http
47  confidence: 3
48  spoofable: 0
49  behavior: 'http:exploit'
50  label: "LatePoint - SQL Injection"
51  classification:
52    - cve.CVE-2024-8911
53    - attack.T1190
54    - cwe.CWE-89
55