by Kastro
Paper/Archive/CVE-2021-24741

CVE-2021-24741

Unknown Support Board — Support Board < 3.3.4 - Multiple Unauthenticated SQL Injections

EPSS 6%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 92.9.929 × 2018.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.

Affected

ProductAffectedFixed inSource
Support Board3.3.4 – < 3.3.43.3.4CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refmedium.com/%40lijohnjefferson/multiple-sql-injection-unauthenticated-in-support-board-v-3-3-3-3e9b4214a4f9refwpscan.com/vulnerability/ccf293ec-7607-412b-b662-5e237b8690carefboard.support/changes