CVE-2021-24295: Time-based Blind SQL Injection in Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4
СleanTalk · Spam protection, AntiSpam, FireWall by CleanTalk
Fixed in 5.153.4 · Affected: СleanTalk Spam protection, AntiSpam, FireWall by CleanTalk before 5.153.4 · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 93% of scored CVEs
Not scored yet. The CVE record carries no CVSS score.
DescriptionCVE.org
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- СleanTalk · Spam protection, AntiSpam, FireWall by CleanTalkfrom 5.153.4 before 5.153.4
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection · nuclei template in projectdiscovery/nuclei-templates
- Weakness
- SQL Injection
- Published
- May 2021
CoverageNo articles yet
No CyberSIXT article names CVE-2021-24295 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.