CVEs-PoC/2021/CVE-2021-24843.md

### [CVE-2021-24843](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24843)
![](https://img.shields.io/static/v1?label=Product&message=SupportCandy%20%E2%80%93%20Helpdesk%20%26%20Support%20Ticket%20System&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.2.7%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen)

### Description

The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.

### POC

#### Reference
- https://wpscan.com/vulnerability/b71f53d7-6b9e-458c-8754-576ad2a52f7d

#### Github
- https://github.com/20142995/nuclei-templates