CVE-2021-24915

Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address

Affected

Contest Gallery – Photo Contest Plugin for WordPress

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

11.55% chance of exploitation in the next 30 days, 96th percentile

Nuclei

critical · CWE-89

Published

2021-11-29

Updated

2024-08-03

Proof-of-concept exploits (2)

• https://gist.github.com/tpmiller87/6c05596fe27dd6f69f1aaba4cbb9c917
• https://wpscan.com/vulnerability/45ee86a7-1497-4c81-98b8-9a8e5b3d4fac

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24915.yaml

References

• CVE Record
• NVD entry