CVE-2021-24626

The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://codevigilant.com/disclosure/2021/wp-plugin-chameleon-css/	Exploit Third Party Advisory
https://wpscan.com/vulnerability/06cb6c14-99b8-45b6-be2e-f4dcca8a4165	Exploit Third Party Advisory
https://codevigilant.com/disclosure/2021/wp-plugin-chameleon-css/	Exploit Third Party Advisory
https://wpscan.com/vulnerability/06cb6c14-99b8-45b6-be2e-f4dcca8a4165	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:chameleon_css_project:chameleon_css:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 05:53

Type	Values Removed	Values Added
References	~~() https://codevigilant.com/disclosure/2021/wp-plugin-chameleon-css/ - Exploit, Third Party Advisory~~	() https://codevigilant.com/disclosure/2021/wp-plugin-chameleon-css/ - Exploit, Third Party Advisory
References	~~() https://wpscan.com/vulnerability/06cb6c14-99b8-45b6-be2e-f4dcca8a4165 - Exploit, Third Party Advisory~~	() https://wpscan.com/vulnerability/06cb6c14-99b8-45b6-be2e-f4dcca8a4165 - Exploit, Third Party Advisory

Information

Published : 2021-11-08 18:15

Updated : 2024-11-21 05:53

NVD link : CVE-2021-24626

Mitre link : CVE-2021-24626

CVE.ORG link : CVE-2021-24626

JSON object : View

Products Affected

chameleon_css_project

chameleon_css

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2021-24626", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-11-08T18:15:08.380", "references": [{"url": "https://codevigilant.com/disclosure/2021/wp-plugin-chameleon-css/", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/06cb6c14-99b8-45b6-be2e-f4dcca8a4165", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://codevigilant.com/disclosure/2021/wp-plugin-chameleon-css/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wpscan.com/vulnerability/06cb6c14-99b8-45b6-be2e-f4dcca8a4165", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-89"}, {"lang": "en", "value": "CWE-352"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}, {"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection"}, {"lang": "es", "value": "El plugin Chameleon CSS de WordPress versiones hasta 1.2, no presenta ninguna comprobaci\u00f3n de CSRF y de capacidad en todas sus llamadas AJAX, que permite que cualquier usuario autenticado, como el suscriptor, las llame y lleve a cabo acciones no autorizadas. Una de las llamadas AJAX, remove_css, tampoco sanea o escapa del par\u00e1metro POST css_id antes de usarlo en una sentencia SQL, conllevando a una inyecci\u00f3n SQL"}], "lastModified": "2024-11-21T05:53:26.383", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chameleon_css_project:chameleon_css:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "8D17F542-8EC7-425A-8D94-F22320F92F40", "versionEndIncluding": "1.2"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}