PT-2021-16365 · WordPress · Contest Gallery

Tyler Miller · Published 2021-11-29 · Updated 2021-12-15 · CVE-2021-24915

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 13.1.0.6

Description: The issue allows unauthenticated attackers to perform SQL injection attacks and obtain a list of all users registered on the blog, including their username and email address. This is due to the lack of capability checks and the failure to sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery.

Recommendations: For versions prior to 13.1.0.6, update to version 13.1.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the user export functionality in the Contest Gallery plugin to minimize the risk of exploitation. Avoid using the cg-search-user-name-original parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24915

Affected Products

Contest Gallery

References · 5

• 🔥 https://gist.github.com/tpmiller87/6c05596fe27dd6f69f1aaba4cbb9c917 · Exploit
• 🔥 https://wpscan.com/vulnerability/45ee86a7-1497-4c81-98b8-9a8e5b3d4fac · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24915 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24915 · Vendor Advisory
• https://t.me/cibsecurity/33013 · Telegram Post