PT-2021-16243 · WordPress · Support Board

John Jefferson Li · Published 2021-09-20 · Updated 2021-10-01 · CVE-2021-24741

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: The Support Board WordPress plugin versions prior to 3.3.4

Description: The issue concerns SQL injections that are exploitable by unauthenticated users due to the failure to escape multiple POST parameters, such as status code, department, user id, conversation id, conversation status code, and recipient id, before using them in SQL statements.

Recommendations: For versions prior to 3.3.4, update to version 3.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24741

Affected Products

Support Board

References · 7

• 🔥 https://wpscan.com/vulnerability/ccf293ec-7607-412b-b662-5e237b8690ca · Exploit
• 🔥 https://medium.com/@lijohnjefferson/multiple-sql-injection-unauthenticated-in-support-board-v-3-3-3-3e9b4214a4f9 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24741 · Vendor Advisory
• https://board.support/changes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24741 · Security Note
• https://t.me/cibsecurity/29082 · Telegram Post
• https://medium.com/%40lijohnjefferson/multiple-sql-injection-unauthenticated-in-support-board-v-3-3-3-3e9b4214a4f9 · Note