CVE-2021-24199

The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/	Third Party Advisory
https://wpdatatables.com/help/whats-new-changelog/	Release Notes Vendor Advisory
https://wpscan.com/vulnerability/5c98c2d6-d002-4cff-9d6f-633cb3ec6280	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tms-outsource:wpdatatables:*:*:*:*:premium:wordpress:*:*

History

No history.

Information

Published : 2021-04-12 14:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-24199

Mitre link : CVE-2021-24199

CVE.ORG link : CVE-2021-24199

JSON object : View

Products Affected

tms-outsource

wpdatatables

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2021-24199", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-04-12T14:15:14.930", "references": [{"url": "https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/", "tags": ["Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpdatatables.com/help/whats-new-changelog/", "tags": ["Release Notes", "Vendor Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/5c98c2d6-d002-4cff-9d6f-633cb3ec6280", "tags": ["Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "The wpDataTables \u2013 Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application."}, {"lang": "es", "value": "El plugin wp DataTables \u2013 Tables & Table Charts premium WordPress versiones anteriores a 3.4.2, permite a un usuario autenticado poco privilegiado llevar a cabo una inyecci\u00f3n SQL ciega basada en Booleanos en la p\u00e1gina de lista de tablas en el endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, en el par\u00e1metro HTTP POST \"start!\". Esto permite a un atacante acceder a todos los datos de la base de datos y conseguir acceso a la aplicaci\u00f3n de WordPress"}], "lastModified": "2021-04-13T20:14:43.687", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tms-outsource:wpdatatables:*:*:*:*:premium:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "00C79193-0FAF-4101-B078-43245C9012E5", "versionEndExcluding": "3.4.2"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}