PT-2021-15929 · WordPress · Gseor – Wordpress Seo Plugin

Syed Sheeraz Ali · Published 2021-09-20 · Updated 2021-09-28 · CVE-2021-24396

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GSEOR – WordPress SEO Plugin versions through 1.3

Description The issue arises from the pageid GET parameter not being sanitised, escaped, or validated before being inserted into a SQL statement, leading to SQL injection. This allows for potential manipulation of database queries.

Recommendations For GSEOR – WordPress SEO Plugin versions through 1.3, consider disabling the pageid GET parameter until a patch is available to prevent SQL injection attacks. Restrict access to SQL queries to minimize the risk of exploitation. Avoid using the pageid parameter in affected API endpoints until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24396

Affected Products

Gseor – Wordpress Seo Plugin

References · 5

• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-gseor · Exploit
• 🔥 https://wpscan.com/vulnerability/28687291-2369-49e0-8905-dc4359454830 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24396 · Security Note
• https://t.me/cvenotify/21150 · Telegram Post