by Kastro
Paper/Archive/CVE-2021-24827

CVE-2021-24827

Unknown Asgaros Forum — Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection

EPSS 13%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.2.962 × 2019.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue

Affected

ProductAffectedFixed inSource
Asgaros Forum1.15.13 – < 1.15.131.15.13CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwpscan.com/vulnerability/36cc5151-1d5e-4874-bcec-3b6326235db1refplugins.trac.wordpress.org/changeset/2611560/asgaros-forum