PT-2021-16175 · WordPress · Game Server Status

Neppah · Published 2021-10-25 · Updated 2021-10-27 · CVE-2021-24662

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Game Server Status WordPress plugin version 1.0

Description The issue concerns an authenticated SQL injection in an admin page. This occurs because the server id parameter is not validated or escaped before being used in a SQL statement.

Recommendations For Game Server Status WordPress plugin version 1.0, consider avoiding the use of the server id parameter in the affected admin page until a patch is available. As a temporary workaround, restrict access to the admin page to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24662

Affected Products

Game Server Status

References · 3

• 🔥 https://wpscan.com/vulnerability/8a74a2a0-3d8c-427f-9a83-0160d652c5f0 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24662 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24662 · Security Note