« Volver al listado

CVE-2021-24774

Estado: ModificadaAlta (7.2)—

The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wpchill — Check & LOG Email

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-24774",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Check & Log Email",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.3",
              "lessThan": "1.0.3",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-10-25T14:15:10.713",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/f80ef09a-d3e2-4d62-8532-f0ebe59ae110",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/f80ef09a-d3e2-4d62-8532-f0ebe59ae110",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the \"order\" and \"orderby\" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues"
    },
    {
      "lang": "es",
      "value": "El plugin Check & Log Email de WordPress versiones anteriores a 1.0.3, no comprueba ni escapa de los parámetros GET \"order\" y \"orderby\" antes de usarlos en una sentencia SQL cuando son visualizados los registros, conllevando a problemas de inyecciones SQL"
    }
  ],
  "lastModified": "2026-06-17T03:40:53.070",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wpchill:check_\\&_log_email:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AFD1BBC-B738-4CF8-A0F4-8370128B8E38",
              "versionEndExcluding": "1.0.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}