PT-2021-16328 · WordPress · Seo Redirection Plugin

Jrxnm + 1 · Published 2021-11-17 · Updated 2021-11-19 · CVE-2021-24847

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SEO Redirection Plugin – 301 Redirect Manager WordPress plugin versions prior to 8.2

Description: The importFromRedirection AJAX action does not properly sanitise the offset parameter before using it in a SQL statement, leading to an SQL injection. This issue is available to any authenticated user when the redirection plugin is also installed.

Recommendations: For versions prior to 8.2, update to version 8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the importFromRedirection AJAX action until a patch is available. Avoid using the offset parameter in the affected AJAX action until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24847

Affected Products

Seo Redirection Plugin

References · 5

• 🔥 https://wpscan.com/vulnerability/679ca6ed-2343-43f3-9c3e-2c12e12407c1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24847 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24847 · Vendor Advisory
• https://t.me/cvenotify/23435 · Telegram Post
• https://t.me/cibsecurity/32496 · Telegram Post