CVE-2021-24348
Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection
Severity Score
7.2
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue
La funcionalidad menu delete del plugin Side Menu - add fixed side buttons de WordPress versiones anteriores a 3.1.5, disponible para los usuarios Administradores, toma el parámetro GET y lo usa en una sentencia SQL sin el saneamiento, comprobación o escape apropiado, conllevando por lo tanto a un problema de Inyección SQL
*Credits:
Shreya Pohekar of Codevigilant Project
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-01-14 CVE Reserved
- 2021-05-27 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2024-10-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (2)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://codevigilant.com/disclosure/2021/wp-plugin-side-menu | 2024-08-03 | |
https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474 | 2024-08-03 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Wow-estore Search vendor "Wow-estore" | Side Menu Search vendor "Wow-estore" for product "Side Menu" | < 3.1.5 Search vendor "Wow-estore" for product "Side Menu" and version " < 3.1.5" | wordpress |
Affected
|