CVE-2021-24554 - Paytm - Donation Plugin <= 1.3.2 - Authenticated (admin+) SQL Injection

Back Back to CVE browser

HIGH

Paytm - Donation Plugin <= 1.3.2 - Authenticated (admin+) SQL Injection

Published Aug 23, 2021

7.2

HIGH

CVSS 3.1

EPSS 6.54%

Description

The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue

Affected products

Vendor n/a Product Paytm – Donation Plugin Default
n/a
- Version
  1.3.2
  Status
  affected
  Constraints
  <=1.3.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Paytm – Donation Plugin

n/a

Version	Status	Constraints
1.3.2	affected	<=1.3.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://codevigilant.com/disclosure/2021/wp-plugin-wp-paytm-pay/
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-11466
Advisory
https://wpscan.com/vulnerability/f2842ac8-76fa-4490-aa0c-5f2b07ecf2ad
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://codevigilant.com/disclosure/2021/wp-plugin-wp-paytm-pay/		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-11466		Advisory
https://wpscan.com/vulnerability/f2842ac8-76fa-4490-aa0c-5f2b07ecf2ad		x_refsource_MISCExploitThird Party Advisory