PT-2021-15858 · WordPress · The Bello

M0Ze + 1 · Published 2021-06-01 · Updated 2021-08-12 · CVE-2021-24321

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Bello - Directory & Listing WordPress theme versions prior to 1.6.0

Description The issue arises from the lack of sanitization of certain parameters before they are used in SQL statements, leading to SQL Injection issues. The parameters bt bb listing field price range to, bt bb listing field now open, bt bb listing field my lng, listing list view, and bt bb listing field my lat are not properly sanitized.

Recommendations For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the parameters bt bb listing field price range to, bt bb listing field now open, bt bb listing field my lng, listing list view, and bt bb listing field my lat to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24321

Affected Products

The Bello

References · 4

• 🔥 https://m0ze.ru/vulnerability/%5B2021-03-21%5D-%5BWordPress%5D-%5BCWE-89%5D-Bello-WordPress-Theme-v1.5.9.txt · Exploit
• 🔥 https://wpscan.com/vulnerability/7314f9fa-c047-4e0c-b145-940240a50c02 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24321 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24321 · Vendor Advisory