sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2021-25109 Futurio Extra < 1.6.3 - Authenticated SQL Injection

Low 2.7 Published Updated

Authenticated high-privilege users can exploit SQL injection to extract database data or perform XSS against admins via malicious links.

Exploited in the wild
Not known
Login needed
An administrator
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2021-25109?

CVE-2021-25109 is a low-severity SQL injection vulnerability in Unknown Futurio Extra, published on 14 Feb 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.

Weakness: CWE-89

Which versions are affected by CVE-2021-25109?

It affects 1 product.

Products include Futuriowp Futurio Extra.

How do I fix CVE-2021-25109?

No fix has been published for CVE-2021-25109 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2021-25109 being exploited?

There is no known exploitation of CVE-2021-25109 in the wild and no public exploit code.

Sources

Also known as GHSA-m7g9-v8qx-6hfp.

Is CVE-2021-25109 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free