CVE-2021-24401

🗓️ 20 Sep 2021 10:06:07Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 39 Views🌐 WEB

The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an `editid` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2021-24401	20 Sep 202114:26	–	circl
CNNVD	WordPress SQL注入漏洞	20 Sep 202100:00	–	cnnvd
Cvelist	CVE-2021-24401 WP Domain Redirect <= 1.0 - Authenticated SQL Injection	20 Sep 202110:06	–	cvelist
EUVD	EUVD-2021-11313	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24401	20 Sep 202110:15	–	nvd
OSV	CVE-2021-24401	20 Sep 202110:15	–	osv
Prion	Sql injection	20 Sep 202110:15	–	prion
RedhatCVE	CVE-2021-24401	22 May 202518:24	–	redhatcve
wpexploit	WP Domain Redirect <= 1.0 - Authenticated SQL Injection	22 Aug 202100:00	–	wpexploit
WPVulnDB	WP Domain Redirect <= 1.0 - Authenticated SQL Injection	22 Aug 202100:00	–	wpvulndb

NVD

Vulners

Node

wp-domain-redirect_project wp-domain-redirectRange≤1.0wordpress

[
  {
    "product": "WP Domain Redirect",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.0",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/f9ae34a9-84c9-4d48-af6a-9e6c786f856e
codevigilant	www.codevigilant.com/disclosure/2021/wp-plugins-domain-redirect/

Parameter	Position	Path	Description	CWE
editid	request body	wp-admin/admin.php?page=add&action=edit&id=1	SQL injection vulnerability via unsanitised editid parameter in Edit domain functionality	CWE-89

21 Nov 2024 05:52Current

7.3High risk

Vulners AI Score7.3

CVSS 26.5

CVSS 3.17.2

EPSS0.0062

CWE-89