.. / CVE-2021-24862

• SQLi
• Nuclei
• Web

Exploit for WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection (CVE-2021-24862)

Description:

WordPress RegistrationMagic plugin before 5.0.1.6 contains an authenticated SQL injection vulnerability. The plugin does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. This is a potential issue in both WordPress and WordPress Administrator.

Nuclei Template

View the template here CVE-2021-24862.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-24862.yaml

References: