daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Enhancement: cves/2021/CVE-2021-24750.yaml by mp

patch-1
MostInterestingBotInTheWorld 2022-06-22 11:28:35 -04:00
parent 6c1221ad08
commit 659f455691
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cves/2021/CVE-2021-24750.yaml
View File

@ -1,15 +1,15 @@
id: CVE-2021-24750 id: CVE-2021-24750
info: info:
name: WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 SQLI name: WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection
author: cckuakilong author: cckuakilong
severity: high severity: high
description: The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks. description: WordPress Visitor Statistics (Real Time Traffic) plugin before 4.8 does not properly sanitize and escape the refUrl in the refDetails AJAX action, which is available to any authenticated user. This could allow users with a role as low as subscriber to perform SQL injection attacks.
reference: reference:
- https://github.com/fimtow/CVE-2021-24750/blob/master/exploit.py - https://github.com/fimtow/CVE-2021-24750/blob/master/exploit.py
- https://nvd.nist.gov/vuln/detail/CVE-2021-24750
- https://wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620de - https://wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620de
- https://plugins.trac.wordpress.org/changeset/2622268 - https://plugins.trac.wordpress.org/changeset/2622268
- https://nvd.nist.gov/vuln/detail/CVE-2021-24750
classification: classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8 cvss-score: 8.8
@ -43,3 +43,5 @@ requests:
- type: status - type: status
status: status:
- 200 - 200
# Enhanced by mp on 2022/06/22