CVE-2021-24398
Last modified
CVE-2021-24398 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. The Add new scene functionality in the Responsive 3D Slider WordPress plugin through 1.2 uses an id parameter which is not sanitised, escaped or validated before being inserted to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query is ran twice.. EPSS estimates a 1.47% chance of exploitation in the next 30 days.
Description
The Add new scene functionality in the Responsive 3D Slider WordPress plugin through 1.2 uses an id parameter which is not sanitised, escaped or validated before being inserted to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query is ran twice.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Webpsilon | Responsive 3d Slider | <= 1.2 |
References
- https://codevigilant.com/disclosure/2021/wp-plugin-morpheus-slider/Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/e6fb2256-0214-4891-b4b7-e4371a1599a5Exploit, Third Party Advisory
- https://codevigilant.com/disclosure/2021/wp-plugin-morpheus-slider/Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/e6fb2256-0214-4891-b4b7-e4371a1599a5Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-24398?
How severe is CVE-2021-24398?
How do I fix CVE-2021-24398?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-24392An id GET parameter of the WordPress Membership SwiftCloud.i…7.2
- CVE-2021-24393A c GET parameter of the Comment Highlighter WordPress plugi…7.2
- CVE-2021-24394An id GET parameter of the Easy Testimonial Manager WordPres…7.2
- CVE-2021-24395The editid GET parameter of the Embed Youtube Video WordPres…7.2
- CVE-2021-24396A pageid GET parameter of the GSEOR – WordPress SEO Plugin W…7.2
- CVE-2021-24397The edit functionality in the MicroCopy WordPress plugin thr…7.2
- CVE-2021-24399The check_order function of The Sorter WordPress plugin thro…7.2
- CVE-2021-2440Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
- CVE-2021-24400The Edit Role functionality in the Display Users WordPress p…7.2
- CVE-2021-24401The Edit domain functionality in the WP Domain Redirect Word…7.2
- CVE-2021-24402The Orders functionality in the WP iCommerce WordPress plugi…7.2
- CVE-2021-24403The Orders functionality in the WordPress Page Contact plugi…7.2
Are you affected by CVE-2021-24398?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST