PT-2021-15923 · WordPress · Wordpress

Syed Sheeraz Ali · Published 2021-09-06 · Updated 2023-02-22 · CVE-2021-24390

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress plugin versions through 3.7.2

Description The issue arises from the proid GET parameter not being properly sanitized, escaped, or validated before being inserted into a SQL statement. This leads to SQL injection.

Recommendations For versions through 3.7.2, update to a version that properly sanitizes the proid GET parameter to prevent SQL injection. As a temporary workaround, consider restricting access to the SQL statement that utilizes the proid parameter until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24390

Affected Products

Wordpress

References · 5

• 🔥 https://wpscan.com/vulnerability/92b0abec-082f-4545-9636-1b2f4dac66fe · Exploit
• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-alipay · Exploit
• https://osv.dev/vulnerability/CVE-2021-24390 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24390 · Security Note
• https://t.me/cibsecurity/28280 · Telegram Post