PT-2021-15840 · WordPress · Jiangqie Official Website Mini Program

Ja9Er + 1 · Published 2021-09-06 · Updated 2021-09-09 · CVE-2021-24303

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JiangQie Official Website Mini Program WordPress plugin versions prior to 1.1.1

Description The issue arises from the plugin's failure to properly escape or validate the id GET parameter before using it in SQL statements, leading to SQL injection issues.

Recommendations For versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint that uses the id parameter in SQL statements until a patch is applied. Avoid using the id parameter in affected SQL statements until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24303

Affected Products

Jiangqie Official Website Mini Program

References · 5

• 🔥 https://github.com/ja9er/CVEProject/blob/main/wordpress_jiangqie-official-website-mini-program_sqli.md · Exploit
• 🔥 https://wpscan.com/vulnerability/cbd65b7d-d3c3-4ee3-8e5e-ff0eeeaa7b30 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24303 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24303 · Vendor Advisory
• https://t.me/cibsecurity/28273 · Telegram Post