Skip to content
Sign in
Not rated

CVE-2021-24741 The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code,…

Description

The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.

Affected products and versions

Product Affected versions Fixed in
Support Board 3.3 earliest → < 3.3.4 3.3.4

Other CVEs of Support Board

The 3 CVEs of Support Board →
CVE-2021-24823 The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php… Not rated CVE-2021-24807 The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting… Not rated
Track this CVE