CVE-2021-24862 : The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input

The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue

Published 2022-01-10 16:15:09

Updated 2022-02-04 15:47:27

Source WPScan

View at NVD, CVE.org

Vulnerability category: Sql Injection

Products affected by CVE-2021-24862

Metagauss » Registrationmagic » For Wordpress
Versions before (<) 5.0.1.6
cpe:2.3:a:metagauss:registrationmagic:*:*:*:*:*:wordpress:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-24862

EPSS FAQ

76.50%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2021-24862

Wordpress RegistrationMagic task_ids Authenticated SQLi

Disclosure Date: 2022-01-23

First seen: 2022-12-23

auxiliary/scanner/http/wp_registrationmagic_sqli

RegistrationMagic, a WordPress plugin, prior to 5.0.1.5 is affected by an authenticated SQL injection via the task_ids parameter. Authors: - h00die - Hacker5preme (Ron Jost)

More information

CVSS scores for CVE-2021-24862

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-24862

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Assigned by: contact@wpscan.com (Primary)

References for CVE-2021-24862

https://wpscan.com/vulnerability/7d3af3b5-5548-419d-aa32-1f7b51622615

Attention Required! | Cloudflare
Exploit;Third Party Advisory
https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-24862

Exploits/Wordpress/CVE-2021-24862 at main · Hacker5preme/Exploits · GitHub
Exploit;Third Party Advisory
http://packetstormsecurity.com/files/165746/WordPress-RegistrationMagic-V-5.0.1.5-SQL-Injection.html

WordPress RegistrationMagic V 5.0.1.5 SQL Injection ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

Jump to