Skip to content
OpenAdvisories
Unscored Public exploit CVE-2021-24741 EUVD-2021-11653GHSA-xr3p-gm2p-7rx5

Support Board < 3.3.4 - Multiple Unauthenticated SQL Injections

Published Sep 20, 2021 · Updated Aug 3, 2024 · Assigned by WPScan

Category: Web / CMS

Description

The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.

Affected products

VendorProductAffectedFixed
— Support Board 3.3.4 – < 3.3.4 3.3.4

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • dldygnl/CVE-2021-24741 ★ 2 · Aug 28, 2021

    Multiple SQL Injection Vulnerability in Support Board Version 3.3.3 that allow remote unauthenticated attacker to execute arbitrary SQL commands via status_code, department, user_id, conversation_id,…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References