Vulnerability CVE-2021-24348


Published: 2021-06-14

Description:
The menu delete functionality of the Side Menu ?????? add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue

Type:

CWE-89

(Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.5/10
6.4/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Wow-estore -> Side menu 

 References:
https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474
https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/

Copyright 2024, cxsecurity.com

 

Back to Top