PT-2021-15921 · WordPress · Vikrentcar Car Rental Management System

Satyender Yadav · Published 2021-07-06 · Updated 2023-02-15 · CVE-2021-24388

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions VikRentCar Car Rental Management System WordPress plugin versions prior to 1.1.7

Description The issue is related to a stored Cross-Site Scripting problem. It arises because the field name in the custom field option is not properly sanitised or escaped before being output back on the page. Additionally, there is no CSRF check performed before saving the setting, which allows attackers to manipulate a logged-in admin into setting arbitrary Custom Fields, including those with XSS payloads.

Recommendations For versions prior to 1.1.7, update to version 1.1.7 or later to resolve the issue. As a temporary workaround, consider disabling the custom field option until a patch is available. Restrict access to the setting management page to minimize the risk of exploitation.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2021-24388

Affected Products

Vikrentcar Car Rental Management System

References · 5

• 🔥 https://wpscan.com/vulnerability/e3f6576f-08cb-4278-8c79-3ef4d0b85cd9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24388 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24388 · Vendor Advisory
• https://t.me/cvenotify/44318 · Telegram Post
• https://t.me/cvenotify/17114 · Telegram Post