CVE-2021-24393

🗓️ 06 Sep 2021 11:09:22Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 36 Views🌐 WEB

A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2021-24393	6 Sep 202114:40	–	circl
CNNVD	WordPress 插件 SQL注入漏洞	6 Sep 202100:00	–	cnnvd
Cvelist	CVE-2021-24393 Comment Highlighter <= 0.13 - Authenticated SQL Injection	6 Sep 202111:09	–	cvelist
EUVD	EUVD-2021-11305	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24393	6 Sep 202111:15	–	nvd
OSV	CVE-2021-24393	6 Sep 202111:15	–	osv
Prion	Sql injection	6 Sep 202111:15	–	prion
RedhatCVE	CVE-2021-24393	22 May 202519:21	–	redhatcve
wpexploit	Comment Highlighter <= 0.13 - Authenticated SQL Injection	23 Jul 202100:00	–	wpexploit
WPVulnDB	Comment Highlighter <= 0.13 - Authenticated SQL Injection	23 Jul 202100:00	–	wpvulndb

NVD

Vulners

Node

comment_highlighter_project comment_highlighterRange≤0.13wordpress

[
  {
    "product": "Comment Highlighter",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "0.13",
        "status": "affected",
        "version": "0.13",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
codevigilant	www.codevigilant.com/disclosure/2021/wp-plugin-comment-highlighter/
wpscan	www.wpscan.com/vulnerability/24969766-19e3-47cd-b32c-6c3330651d1f

Parameter	Position	Path	Description	CWE
c	query param	GET /wp-admin/options-general.php?page=comment-highlighter/comment_highlighter.php&c=-6104%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,user(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- HTTP/1.1	SQL injection in c parameter of Comment Highlighter WordPress plugin (unsanitized input used in SQL statement)	CWE-89

21 Nov 2024 05:52Current

7.3High risk

Vulners AI Score7.3

CVSS 26.5

CVSS 3.17.2

EPSS0.00567

CWE-89