PT-2021-15934 · WordPress · Wp Domain Redirect

Syed Sheeraz Ali · Published 2021-09-20 · Updated 2021-09-29 · CVE-2021-24401

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Domain Redirect WordPress plugin versions 1.0 and earlier

Description The issue concerns the Edit domain functionality in the WP Domain Redirect WordPress plugin, where the editid parameter is not properly sanitized, escaped, or validated before being inserted into a SQL statement. This oversight leads to SQL injection.

Recommendations For WP Domain Redirect WordPress plugin versions 1.0 and earlier, as a temporary workaround, consider restricting access to the Edit domain functionality until a patch is available. Avoid using the editid parameter in the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24401

Affected Products

Wp Domain Redirect

References · 6

• 🔥 https://codevigilant.com/disclosure/2021/wp-plugins-domain-redirect · Exploit
• 🔥 https://wpscan.com/vulnerability/f9ae34a9-84c9-4d48-af6a-9e6c786f856e · Exploit
• https://osv.dev/vulnerability/CVE-2021-24401 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24401 · Security Note
• https://t.me/cibsecurity/29084 · Telegram Post
• https://t.me/cvenotify/21146 · Telegram Post