CVE-2021-25045 Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_id
An attacker with admin privileges can execute arbitrary SQL commands via the forum_id parameter in the Asgaros Forum plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-25045?
CVE-2021-25045 is a high-severity SQL injection vulnerability in Unknown Asgaros Forum, published on 24 Jan 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue
Weakness: CWE-89
Which versions are affected by CVE-2021-25045?
It affects 1 product.
Products include Asgaros Asgaros Forum.
How do I fix CVE-2021-25045?
No fix has been published for CVE-2021-25045 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-25045 being exploited?
There is no known exploitation of CVE-2021-25045 in the wild and no public exploit code.
Other vulnerabilities in Unknown Asgaros Forum
- CVE-2023-5604 Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload
- CVE-2021-24827 Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
- CVE-2022-0411 Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection
- CVE-2024-22284 WordPress Asgaros Forum Plugin <= 2.7.2 is vulnerable to PHP Object Injection
- CVE-2022-41608 WordPress Asgaros Forum Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF)
Sources
Also known as GHSA-g4j5-9jfg-qj9h.