PT-2021-15677 · 10Web · The Slider By 10Web

Nguyen Anh Tien · Published 2021-03-18 · Updated 2021-03-24 · CVE-2021-24132

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: The Slider by 10Web WordPress plugin versions prior to 1.2.36

Description: The issue allows a high privileged user, such as an Admin, or a medium privileged user, like Contributor+, to perform SQL Injection attacks if "Role Options" is turned on for other users. This is due to vulnerabilities in the bulk action, export full, and save slider db functionalities of the plugin.

Recommendations: For versions prior to 1.2.36, update to version 1.2.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the bulk action, export full, and save slider db functionalities until a patch is applied. Additionally, review and restrict "Role Options" for non-admin users to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24132

Affected Products

The Slider By 10Web

References · 4

• 🔥 https://wpscan.com/vulnerability/c1f45000-6c16-4606-be80-1938a755af2c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24132 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24132 · Vendor Advisory
• https://t.me/cibsecurity/25113 · Telegram Post