Description

WordPress Plugin Chat-Support Board-WordPress Chat is prone to multiple SQL injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin Chat-Support Board-WordPress Chat version 3.3.3 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 3.3.4 or latest

References

https://medium.com/@lijohnjefferson/multiple-sql-injection-unauthenticated-in-support-board-v-3-3-3-3e9b4214a4f9

https://www.exploit-db.com/exploits/50294

https://board.support/changes

Related Vulnerabilities

WordPress Plugin Essential Real Estate Cross-Site Scripting (1.7.0)

WordPress Plugin Survey Maker-Best WordPress Survey Cross-Site Scripting (2.0.6)

Joomla URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2020-24598)

WordPress Plugin MailUp newsletter sign-up form Security Bypass (1.3.2)

WordPress Plugin WordPress File Upload Multiple Unspecified Vulnerabilities (3.10.0)

Severity

High

Classification

CVE-2021-24741 CWE-89 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection