PT-2021-16142 · WordPress · Chameleon Cms

Shreya Pohekar · Published 2021-11-08 · Updated 2022-11-09 · CVE-2021-24626

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chameleon CSS WordPress plugin versions 1.2 and earlier

Description The issue allows any authenticated user to perform unauthorized actions due to the lack of CSRF and capability checks in all AJAX calls. Specifically, the remove css AJAX call is vulnerable to SQL Injection because it does not sanitize or escape the css id POST parameter before using it in a SQL statement. This allows attackers to inject malicious SQL code.

Recommendations For Chameleon CSS WordPress plugin versions 1.2 and earlier, update to a version that includes CSRF and capability checks for all AJAX calls and properly sanitizes user input to prevent SQL Injection. As a temporary workaround, consider restricting access to the remove css AJAX call until a patch is available. Avoid using the css id parameter in the affected AJAX endpoint until the issue is resolved.

Exploit

Fix

SQL injection

CSRF

Weakness Enumeration

CWE-89

CWE-352

Related Identifiers

CVE-2021-24626

Affected Products

Chameleon Cms

References · 5

• 🔥 https://wpscan.com/vulnerability/06cb6c14-99b8-45b6-be2e-f4dcca8a4165 · Exploit
• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-chameleon-css · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24626 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24626 · Vendor Advisory
• https://t.me/cvenotify/33904 · Telegram Post