NVD Vulnerability Detail

CVE-2021-24295

Summary	It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
Publication Date	May 18, 2021, 2:15 a.m.
Registration Date	May 18, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 2:52 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:cleantalk:spam_protection\,_antispam\,_firewall::::::wordpress::*					5.153.4

Related information, measures and tools

No	URL	タグ
1	https://wpscan.com/vulnerability/152171fc-888c-4275-a118-5a1e664ef28b	Third Party Advisory
2	https://wpscan.com/vulnerability/152171fc-888c-4275-a118-5a1e664ef28b	Third Party Advisory
3	https://www.wordfence.com/blog/2021/05/sql-injection-vulnerability-patched-in-cleantalk-antispam-plugin/	Exploit Third Party Advisory
4	https://www.wordfence.com/blog/2021/05/sql-injection-vulnerability-patched-in-cleantalk-antispam-plugin/	Exploit Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

WordPress 用 Spam protection, AntiSpam, FireWall by CleanTalk プラグインにおける SQL インジェクションの脆弱性

Title	WordPress 用 Spam protection, AntiSpam, FireWall by CleanTalk プラグインにおける SQL インジェクションの脆弱性
Summary	WordPress 用 Spam protection, AntiSpam, FireWall by CleanTalk プラグインには、SQL インジェクションの脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	May 3, 2021, midnight
Registration Date	Feb. 4, 2022, 2:14 p.m.
Last Update	Feb. 4, 2022, 2:14 p.m.

Affected System

CleanTalk

Spam protection, AntiSpam, FireWall 5.153.4 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-24295	https://www.cve.org/CVERecord?id=CVE-2021-24295
National Vulnerability Database (NVD)
2	CVE-2021-24295	https://nvd.nist.gov/vuln/detail/CVE-2021-24295

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
CleanTalk
1	Top Page	https://cleantalk.org/
WordPress Plugin Directory
2	Spam protection, AntiSpam, FireWall by CleanTalk	https://wordpress.org/plugins/cleantalk-spam-protect/

その他

No	Name	URL
関連文書
1	Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection	https://wpscan.com/vulnerability/152171fc-888c-4275-a118-5a1e664ef28b

Change Log

No	Changed Details	Date of change
1	[2022年02月04日] 掲載	Feb. 4, 2022, 11:52 a.m.