Lucene search

WPScanCVE-2021-24575

HistoryNov 08, 2021 - 6:15 p.m.

CVE-2021-24575

2021-11-0818:15:08

CWE-89

WPScan

web.nvd.nist.gov

cve-2021-24575

school management system

wpschoolpress

wordpress plugin

sql injection

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

37.7%

JSON

The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to teachers and above.

Affected configurations

Nvd

Vulners

Node

igexsolutionswpschoolpressRange<2.1.10wordpress

VendorProductVersionCPE
igexsolutionswpschoolpress*cpe:2.3:a:igexsolutions:wpschoolpress:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
igexsolutions	wpschoolpress	*	cpe:2.3:a:igexsolutions:wpschoolpress::::::wordpress::*

CNA Affected

[
  {
    "product": "School Management System – WPSchoolPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.1.10",
        "status": "affected",
        "version": "2.1.10",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/83c9c3af-9eca-45e0-90d7-edc69e616e6a

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

37.7%

JSON

Related for CVE-2021-24575