PT-2024-16373 · WordPress · Cleantalk

Michael Mazzolini + 1 · Published 2024-11-26 · Updated 2024-12-01 · CVE-2024-10570

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Security & Malware scan by CleanTalk plugin for WordPress versions up to, and including, 2.145

Description The issue is related to unauthorized SQL Injection due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function, as well as insufficient input sanitization and validation. This allows unauthenticated attackers to append additional SQL queries into existing queries, potentially extracting sensitive information from the database.

Recommendations For versions up to, and including, 2.145, update to a version that addresses the authorization bypass and input sanitization issues. As a temporary workaround, consider restricting access to the checkWithoutToken function until a patch is available. Avoid using the plugin until the issue is resolved, to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-10570

Affected Products

Cleantalk

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-10570 · Security Note
• https://t.me/latest_high_impact_cve/1567 · Telegram Post
• https://plugins.trac.wordpress.org/browser/security-malware-firewall/tags/2.145/lib/CleantalkSP/Common/RemoteCalls.php#L59 · Note
• https://twitter.com/cracbot/status/1863100845895876785 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2187311d-6651-4eca-806d-aa2ff9fae4e2?source=cve · Note
• https://twitter.com/CVEnew/status/1861286372285239741 · Twitter Post