cbcvebase.
CVE-2021-24666
published 2021-09-27

CVE-2021-24666: The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route…

PriorityP277critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
9.40%
94.8th percentile
The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.

Affected

1 ranges
VendorProductVersion rangeFixed in
podlovepodlove_podcast_publisher< 3.5.63.5.6

Detection & IOCsextracted from sources · hover to see the quote

url/index.php?rest_route=/podlove/v1/social/services/contributor/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20-↗
path/podlove/v1/social/services/contributor/↗
command1 UNION ALL SELECT NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL-- -↗
  • →Look for GET requests to the REST route /podlove/v1/social/services/contributor/{id} with SQL injection payloads in the 'id' or 'category' query parameters (e.g., UNION SELECT statements). ↗
  • →A successful exploitation response will contain the JSON field '"service_id"' and the MD5 hash '66a82937a7660b73b00d4f7cefee6c85' in the body, with Content-Type 'application/json' and HTTP 200 status. ↗
  • →The vulnerable REST endpoint is only exposed when the 'Social & Donations' module is activated in the Podlove Podcast Publisher plugin (not active by default). Scope detection to sites running this plugin. ↗
  • ·The 'Social & Donations' module is NOT activated by default; the vulnerable REST endpoint only exists on installations where this module has been explicitly enabled. ↗
  • ·The vulnerability affects Podlove Podcast Publisher versions before 3.5.6; the fix was introduced in commit aa8a343a2e2333b34a422f801adee09b020c6d76. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.