CVE-2021-24144

🗓️ 18 Mar 2021 14:57:50Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 58 Views🌐 WEB

Unvalidated input in Contact Form 7 Database Addon plugin, versions before 1.2.5.6, lets remote attackers inject arbitrary formulas into CSV files

Reporter	Title	Published	Views	Family All 11
CNNVD	Wordpress Contact Form 7 Database Addon 注入漏洞	18 Mar 202100:00	–	cnnvd
CNVD	Wordpress Contact Form 7 Database Addon plugin input validation error vulnerability	19 Mar 202100:00	–	cnvd
Cvelist	CVE-2021-24144 Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection	18 Mar 202114:57	–	cvelist
EUVD	EUVD-2021-11058	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24144	18 Mar 202115:15	–	nvd
OpenVAS	WordPress Contact Form 7 Database Addon Plugin (CFDB7) < 1.2.5.8 CSV Injection Vulnerability	24 Mar 202100:00	–	openvas
Prion	Design/Logic Flaw	18 Mar 202115:15	–	prion
Positive Technologies	PT-2021-15690 · WordPress · Contact Form 7 Database Addon	18 Mar 202100:00	–	ptsecurity
RedhatCVE	CVE-2021-24144	22 May 202519:20	–	redhatcve
wpexploit	Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection	25 Jan 202100:00	–	wpexploit

NVD

Vulners

Node

ciphercoin contact_form_7_database_addonRange<1.2.5.6wordpress

[
  {
    "product": "Contact Form 7 Database Addon",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.2.5.6",
        "status": "affected",
        "version": "1.2.5.6",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/143cdaff-c536-4ff9-8d64-c617511ddd48

Parameter	Position	Path	Description	CWE
your-name	request body	/wp-json/contact-form-7/v1/contact-forms/219/feedback	Unvalidated input in the Contact Form 7 Database Addon allows CSV injection via form fields (e.g., =SUM(…) and =1+1) leading to potential command execution or data leakage.	CWE-1236, CWE-74
your-subject	request body	/wp-json/contact-form-7/v1/contact-forms/219/feedback	Unvalidated input in the Contact Form 7 Database Addon allows CSV injection via form fields (e.g., =SUM(…) and =1+1) leading to potential command execution or data leakage.	CWE-1236, CWE-74
your-message	request body	/wp-json/contact-form-7/v1/contact-forms/219/feedback	Unvalidated input in the Contact Form 7 Database Addon allows CSV injection via form fields (e.g., =SUM(…) and =1+1) leading to potential command execution or data leakage.	CWE-1236, CWE-74
your-email	request body	/wp-json/contact-form-7/v1/contact-forms/219/feedback	Unvalidated input in the Contact Form 7 Database Addon allows CSV injection via form fields (e.g., =SUM(…) and =1+1) leading to potential command execution or data leakage.	CWE-1236, CWE-74

21 Nov 2024 05:52Current

7.5High risk

Vulners AI Score7.5

CVSS 26.8

CVSS 3.17.8

EPSS0.00414

cve-2021-24144 contact form 7 database addon plugin vulnerability remote attackers csv files