.. / CVE-2021-24666

• SQLi
• Nuclei
• Web

Exploit for WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection (CVE-2021-24666)

Description:

WordPress Podlove Podcast Publisher plugin before 3.5.6 is susceptible to SQL injection. The Social & Donations module, not activated by default, adds the REST route /services/contributor/(?P[\d]+) and takes id and category parameters as arguments. Both parameters can be exploited, thereby potentially enabling an attacker to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.

Nuclei Template

View the template here CVE-2021-24666.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-24666.yaml

References: