CVE-2021-24340

HIGHNuclei

WP Statistics < 13.0.8 - Unauthenticated SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24340 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

WP Statistics

Browse VeronaLabs / WP Statistics
CVE List13.0.8 to < 13.0.8affected

Nuclei templates

1
ProjectDiscoveryHIGHWordPress Statistics <13.0.8 - Blind SQL InjectionCVSS 7.5

WordPress Statistic plugin versions prior to version 13.0.8 are affected by an unauthenticated time-based blind SQL injection vulnerability.

Impact

Unauthenticated attackers can extract database contents via time-based blind SQL injection, potentially exposing sensitive WordPress configuration and user data.

Remediation

Update to WordPress Statistics plugin version 13.0.8 or later to mitigate the vulnerability.

WeaknessesCWE-89
Authorslotusdll, j4vaovo
Template tagstime-based-sqlicve2021cvewp-pluginunauthwpscanwordpresssqliblindedbveronalabsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/wp-statistics/
FOFA: body=/wp-content/plugins/wp-statistics/
Google: inurl:/wp-content/plugins/wp-statistics
https://www.exploit-db.com/exploits/49894 https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/ https://github.com/Udyz/WP-Statistics-BlindSQL https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c https://nvd.nist.gov/vuln/detail/CVE-2021-24340

Source: ProjectDiscovery

References

3