CVE-2021-24385

🗓️ 12 Jul 2021 19:20:50Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 49 Views🌐 WEB

Filebird Plugin 4.7.3 SQL injection vulnerabilit

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress 插件 SQL注入漏洞	12 Jul 202100:00	–	cnnvd
CNVD	WordPress plugin has an unspecified vulnerability (CNVD-2021-59593)	14 Jul 202100:00	–	cnvd
Cvelist	CVE-2021-24385 Filebird 4.7.3 - Unauthenticated SQL Injection	12 Jul 202119:20	–	cvelist
EUVD	EUVD-2021-11297	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24385	12 Jul 202120:15	–	nvd
OpenVAS	WordPress Filebird plugin 4.7.3 SQLi Vulnerability	20 Jul 202100:00	–	openvas
Patchstack	WordPress Filebird plugin 4.7.3 - Unauthenticated SQL Injection (SQLi) vulnerability	16 Jun 202100:00	–	patchstack
Prion	Sql injection	12 Jul 202120:15	–	prion
RedhatCVE	CVE-2021-24385	22 May 202521:05	–	redhatcve
wpexploit	Filebird 4.7.3 - Unauthenticated SQL Injection	16 Jun 202100:00	–	wpexploit

NVD

Vulners

Node

ninjateam filebirdMatch4.7.3wordpress

[
  {
    "product": "FileBird – WordPress Media Library Folders & File Manager",
    "vendor": "Ninja Team",
    "versions": [
      {
        "lessThan": "4.7.3*",
        "status": "affected",
        "version": "4.7.3",
        "versionType": "custom"
      },
      {
        "lessThan": "4.7.4",
        "status": "affected",
        "version": "4.7.4",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
10up	www.10up.com/blog/2021/security-vulnerability-filebird-wordpress-plugin/
wpscan	www.wpscan.com/vulnerability/754ac750-0262-4f65-b23e-d5523995fbfa

Parameter	Position	Path	Description	CWE
selectedFolder	request body	wp-json/filebird/v1/gutenberg-get-images	SQL injection via unsafely included user input in POST to Filebird Gutenberg images endpoint with no auth required	CWE-89

21 Nov 2024 05:52Current

9.9High risk

Vulners AI Score9.9

CVSS 27.5

CVSS 3.19.8

EPSS0.09019

CWE-89