PT-2021-15873 · WordPress · Video Embed Wordpress Plugin

Syed Sheeraz Ali · Published 2021-06-07 · Updated 2021-07-15 · CVE-2021-24337

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Video Embed WordPress plugin versions 1.0 and earlier

Description The issue concerns the id GET parameter in one of the Video Embed WordPress plugin's pages, which is accessible via forced browsing. This parameter is not sanitized, validated, or escaped before being used in a SQL statement, allowing low-privilege users, such as subscribers, to perform SQL injection.

Recommendations For Video Embed WordPress plugin versions 1.0 and earlier, consider disabling the vulnerable page or restricting access to it until a patch is available. Avoid using the id GET parameter in the affected page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24337

Affected Products

Video Embed Wordpress Plugin

References · 5

• 🔥 https://wpscan.com/vulnerability/a8fd8dd4-5b5e-462e-8dae-065d5e2d003a · Exploit
• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-video-embed-box · Exploit
• https://osv.dev/vulnerability/CVE-2021-24337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24337 · Security Note
• https://t.me/cvenotify/15679 · Telegram Post