CVE-2021-24626
Summary
| CVE | CVE-2021-24626 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-11-08 18:15:00 UTC |
| Updated | 2022-11-09 21:43:00 UTC |
| Description | The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection |
Risk And Classification
Problem Types: CWE-352 | CWE-89
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Chameleon Css Project | Chameleon Css | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Attention Required! | Cloudflare | MISC | wpscan.com | |
| wp-plugin : chameleon-css | Code Vigilant : to err is human.. To fix is Humanity | MISC | codevigilant.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Shreya Pohekar of Codevigilant Project
There are currently no legacy QID mappings associated with this CVE.