CVE-2021-24750 – WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection

https://notcve.org/view.php?id=CVE-2021-24750

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks El plugin WP Visitor Statistics (Real Time Traffic) de WordPress versiones anteriores a 4.8, no sanea y escapa correctamente de la refUrl en la acción refDetails AJAX, disponible para cualquier usuario autenticado, que podría permitir a usuarios con un rol tan bajo como el de suscriptor llevar a cabo ataques de inyección SQL WordPress WP Visitor Statistics plugin versions 4.7 and below suffer from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/50619 https://github.com/fimtow/CVE-2021-24750 http://packetstormsecurity.com/files/165433/WordPress-WP-Visitor-Statistics-4.7-SQL-Injection.html https://plugins.trac.wordpress.org/changeset/2622268 https://wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620de • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •