PT-2021-16341 · WordPress · Bsk Pdf Manager

Jrxnm + 1 · Published 2021-11-29 · Updated 2021-11-29 · CVE-2021-24860

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: BSK PDF Manager WordPress plugin versions prior to 3.1.2

Description: The issue arises from the lack of validation and escaping of the orderby and order parameters before they are used in a SQL statement, leading to a SQL injection issue.

Recommendations: For versions prior to 3.1.2, update to version 3.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL statement that utilizes the orderby and order parameters until a patch is applied. Avoid using the orderby and order parameters in SQL statements until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24860

Affected Products

Bsk Pdf Manager

References · 5

• 🔥 https://wpscan.com/vulnerability/d5891973-37d0-48cb-a5a3-a26c771b3369 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24860 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24860 · Vendor Advisory
• https://t.me/cibsecurity/33023 · Telegram Post
• https://t.me/cvenotify/23875 · Telegram Post