PT-2021-16077 · Unknown · Rslider Page

Shreya Pohekar · Published 2021-08-23 · Updated 2021-08-30 · CVE-2021-24557

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rslider page (affected versions not specified)

Description The issue concerns the update functionality in the rslider page, which uses an rs id POST parameter. This parameter is not validated, sanitised, or escaped before being inserted into an SQL query, leading to SQL injection. This exploit is specifically relevant for users with an Administrator role.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24557

Affected Products

Rslider Page

References · 5

• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider · Exploit
• 🔥 https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24557 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24557 · Vendor Advisory
• https://t.me/cvenotify/19889 · Telegram Post