CVE-2021-24915

Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address

El plugin Contest Gallery de WordPress versiones anteriores a 13.1.0.6, no presenta comprobaciones de capacidad y no sanea o escapa del parámetro cg-search-user-name-original antes de usarlo en una sentencia SQL cuando son exportados usuarios de una galería, lo que podría permitir a personas no autenticadas llevar a cabo ataques de inyecciones SQL, así como conseguir la lista de todos los usuarios registrados en el blog, incluyendo su nombre de usuario y dirección de correo electrónico

*Credits: Tyler Miller

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-01-14 CVE Reserved
2021-11-29 CVE Published
2024-08-03 CVE Updated
2024-08-03 First Exploit
2024-11-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC
https://gist.github.com/tpmiller87/6c05596fe27dd6f69f1aaba4cbb9c917	2024-08-03
https://wpscan.com/vulnerability/45ee86a7-1497-4c81-98b8-9a8e5b3d4fac	2024-08-03

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Contest Gallery Search vendor "Contest Gallery"		Contest Gallery Search vendor "Contest Gallery" for product "Contest Gallery"				< 13.1.0.6 Search vendor "Contest Gallery" for product "Contest Gallery" and version " < 13.1.0.6"		wordpress		Affected