PT-2021-15896 · WordPress · Yes/No Chart Wordpress Plugin

Apple502J · Published 2021-06-14 · Updated 2021-06-17 · CVE-2021-24360

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Yes/No Chart WordPress plugin versions prior to 1.0.12

Description The issue allows medium privilege users, specifically those with contributor or higher privileges, to perform Blind SQL Injection attacks due to the lack of sanitization of the sid shortcode parameter before its use in a SQL statement.

Recommendations For versions prior to 1.0.12, update to version 1.0.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the shortcode that utilizes the sid parameter to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24360

Affected Products

Yes/No Chart Wordpress Plugin

References · 4

• 🔥 https://wpscan.com/vulnerability/d9586453-cc5c-4d26-bb45-a6370c9427fe · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24360 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24360 · Vendor Advisory
• https://t.me/cvenotify/16249 · Telegram Post