PT-2021-15835 · Igor Benic+2 · Simple Giveaways – Grow Your Business+2

Shreya Pohekar · Published 2021-05-24 · Updated 2021-05-28 · CVE-2021-24298

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue arises from the method and share GET parameters of the Giveaway pages not being sanitised, validated, or escaped before being output back in the pages. This leads to reflected XSS. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24298

Affected Products

Simple Giveaways – Grow Your Business

Giveasap

Simple Giveaways

References · 5

• 🔥 https://wpscan.com/vulnerability/30aebded-3eb3-4dda-90b5-12de5e622c91 · Exploit
• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-giveasap-xss · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24298 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24298 · Vendor Advisory
• https://t.me/cvenotify/15234 · Telegram Post