Vulnerability Details CVE-2021-24823
The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 37.3%
CVSS Severity
CVSS v3 Score 8.1
CVSS v2 Score 4.9
References
- https://noob3xploiter.medium.com/support-board-3-3-4-arbitrary-file-deletion-to-remote-code-execution-da4c45b45c83
- https://wpscan.com/vulnerability/1bdebd9e-a7f2-4f55-b5b0-185eb619ebaf
- https://noob3xploiter.medium.com/support-board-3-3-4-arbitrary-file-deletion-to-remote-code-execution-da4c45b45c83
- https://wpscan.com/vulnerability/1bdebd9e-a7f2-4f55-b5b0-185eb619ebaf
Products affected by CVE-2021-24823
-
cpe:2.3:a:schiocco:support_board:-
-
cpe:2.3:a:schiocco:support_board:1.2.3
-
cpe:2.3:a:schiocco:support_board:1.2.8
-
cpe:2.3:a:schiocco:support_board:3.0.0
-
cpe:2.3:a:schiocco:support_board:3.0.1
-
cpe:2.3:a:schiocco:support_board:3.0.2
-
cpe:2.3:a:schiocco:support_board:3.0.3
-
cpe:2.3:a:schiocco:support_board:3.0.4
-
cpe:2.3:a:schiocco:support_board:3.0.5
-
cpe:2.3:a:schiocco:support_board:3.0.6
-
cpe:2.3:a:schiocco:support_board:3.0.7
-
cpe:2.3:a:schiocco:support_board:3.0.8
-
cpe:2.3:a:schiocco:support_board:3.0.9
-
cpe:2.3:a:schiocco:support_board:3.1.0
-
cpe:2.3:a:schiocco:support_board:3.1.1
-
cpe:2.3:a:schiocco:support_board:3.1.2
-
cpe:2.3:a:schiocco:support_board:3.1.3
-
cpe:2.3:a:schiocco:support_board:3.1.4
-
cpe:2.3:a:schiocco:support_board:3.1.5
-
cpe:2.3:a:schiocco:support_board:3.1.6
-
cpe:2.3:a:schiocco:support_board:3.1.7
-
cpe:2.3:a:schiocco:support_board:3.1.8
-
cpe:2.3:a:schiocco:support_board:3.1.9
-
cpe:2.3:a:schiocco:support_board:3.2.0
-
cpe:2.3:a:schiocco:support_board:3.2.1
-
cpe:2.3:a:schiocco:support_board:3.2.2
-
cpe:2.3:a:schiocco:support_board:3.2.3
-
cpe:2.3:a:schiocco:support_board:3.2.4
-
cpe:2.3:a:schiocco:support_board:3.2.5
-
cpe:2.3:a:schiocco:support_board:3.2.6
-
cpe:2.3:a:schiocco:support_board:3.2.7
-
cpe:2.3:a:schiocco:support_board:3.2.8
-
cpe:2.3:a:schiocco:support_board:3.2.9
-
cpe:2.3:a:schiocco:support_board:3.3.0
-
cpe:2.3:a:schiocco:support_board:3.3.1
-
cpe:2.3:a:schiocco:support_board:3.3.2
-
cpe:2.3:a:schiocco:support_board:3.3.3
-
cpe:2.3:a:schiocco:support_board:3.3.4
-
cpe:2.3:a:schiocco:support_board:3.3.5