CVE-2021-24295 Time-based Blind SQL Injection in Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4

Q: What is CVE-2021-24295?

CVE-2021-24295 is a high-severity SQL injection vulnerability in СleanTalk Spam protection, AntiSpam, FireWall by CleanTalk, published on 17 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2021-24295 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24295 exists.

Q: How do I fix CVE-2021-24295?

No fix has been published for CVE-2021-24295 yet. Limit exposure of the affected software until one is available.

High 7.5 Published 17 May 2021 Updated 3 Aug 2024

Unauthenticated attackers can perform time-based blind SQL injection via manipulated cookies in the CleanTalk WordPress plugin, allowing data extraction.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-24295?

CVE-2021-24295 is a high-severity SQL injection vulnerability in СleanTalk Spam protection, AntiSpam, FireWall by CleanTalk, published on 17 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.

Weakness: CWE-89

Which versions are affected by CVE-2021-24295?

It affects 1 product.

Products include Cleantalk Spam Protection\, Antispam\, Firewall.

How do I fix CVE-2021-24295?

No fix has been published for CVE-2021-24295 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2021-24295 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24295 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-3897-7ph5-mf8c.