CVEs-PoC/2021/CVE-2021-24741.md

CVE-2021-24741

Description

The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.

POC

Reference

• https://medium.com/@lijohnjefferson/multiple-sql-injection-unauthenticated-in-support-board-v-3-3-3-3e9b4214a4f9
• https://medium.com/@lijohnjefferson/multiple-sql-injection-unauthenticated-in-support-board-v-3-3-3-3e9b4214a4f9
• https://wpscan.com/vulnerability/ccf293ec-7607-412b-b662-5e237b8690ca
• https://wpscan.com/vulnerability/ccf293ec-7607-412b-b662-5e237b8690ca

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/itsjeffersonli/CVE-2021-24741
• https://github.com/k0mi-tg/CVE-POC
• https://github.com/manas3c/CVE-POC
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/whoforget/CVE-POC
• https://github.com/youwizard/CVE-POC