PT-2021-15884 · WordPress · Side Menu – Add Fixed Side Buttons

Shreya Pohekar · Published 2021-06-14 · Updated 2021-06-21 · CVE-2021-24348

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Side Menu – add fixed side buttons WordPress plugin versions prior to 3.1.5

Description The issue concerns the menu delete functionality, which is accessible to Administrator users. It takes the did GET parameter and uses it in an SQL statement without proper sanitization, validation, or escaping, leading to a SQL Injection issue.

Recommendations For versions prior to 3.1.5, update to version 3.1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the menu delete functionality to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24348

Affected Products

Side Menu – Add Fixed Side Buttons

References · 5

• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-side-menu · Exploit
• 🔥 https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24348 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24348 · Vendor Advisory
• https://t.me/cvenotify/16246 · Telegram Post