CVE-2021-24704 Orange Form <= 1.0 - SQL Injection via CSRF

2022-02-2809:06:06

CWE-352

CWE-89

WPScan

www.cve.org

9.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in “admin/orange-form-email.php” performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example

CNA Affected

[
  {
    "product": "Orange Form",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.0",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  }
]