CVE-2021-24137 Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL Injection
Authenticated attackers can inject arbitrary SQL commands via the Re-Share Posts feature in the Blog2Social WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24137?
CVE-2021-24137 is a high-severity SQL injection vulnerability in Unknown Blog2Social: Social Media Auto Post & Scheduler, published on 18 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands.
Weakness: CWE-89
Which versions are affected by CVE-2021-24137?
It affects 1 product.
Products include Adenion Blog2social.
How do I fix CVE-2021-24137?
No fix has been published for CVE-2021-24137 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-24137 being exploited?
There is no known exploitation of CVE-2021-24137 in the wild and no public exploit code.
Other vulnerabilities in Unknown Blog2Social: Social Media Auto Post & Scheduler
- CVE-2024-3549 Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection
- CVE-2019-13572 SQL injection in n/a
- CVE-2022-3246 Blog2Social < 6.9.10 - Subscriber+ SQLi
- CVE-2023-40554 WordPress Blog2Social Plugin <= 7.2.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2022-3247 Blog2Social < 6.9.10 - Subscriber+ SSRF
Sources
Also known as GHSA-fxmq-6v3w-26hj.