CVE-2021-24731

CRITICALNuclei

Pie Register < 3.7.1.6 - Unauthenticated SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24731 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes

CVE List3.7.1.6 to < 3.7.1.6affected

Nuclei templates

1
ProjectDiscoveryCRITICALPie Register < 3.7.1.6 - SQL InjectionCVSS 9.8

The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Fixed in version 3.7.1.6

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2021sqliwpscanwordpresswp-pluginwppie-registerunauthgenetechsolutionsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:genetechsolutions:pie_register:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/6bed00e4-b363-43b8-a392-d068d342151a https://wordpress.org/plugins/pie-register/ https://nvd.nist.gov/vuln/detail/CVE-2021-24731

Source: ProjectDiscovery

References

2