CVE-2021-24336
📋 TL;DR
This SQL injection vulnerability in the FlightLog WordPress plugin allows authenticated users with editor or administrator privileges to execute arbitrary SQL commands. Attackers could read, modify, or delete database content, potentially compromising the entire WordPress installation. Only WordPress sites running the vulnerable FlightLog plugin are affected.
💻 Affected Systems
- FlightLog WordPress Plugin
📦 What is this software?
Flightlog by Zavedil
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, site defacement, or full system takeover if database user has elevated privileges.
Likely Case
Unauthorized data access, modification of plugin data, or extraction of sensitive information like user credentials from the WordPress database.
If Mitigated
Limited impact due to proper access controls, but still potential for data manipulation within the plugin's scope.
🎯 Exploit Status
SQL injection is well-understood with many available tools. Requires authenticated access as editor or administrator.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.3 or later
Vendor Advisory: https://wpscan.com/vulnerability/dda0593e-cd97-454e-a8c8-15d7f690311c
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find FlightLog plugin. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and delete plugin, then install latest version from WordPress repository.
🔧 Temporary Workarounds
Disable FlightLog Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate flightlog
Restrict User Privileges
allLimit editor and administrator accounts to trusted users only
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Remove editor and administrator access from untrusted users
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for FlightLog version 3.0.2 or earlierCheck Version:
wp plugin get flightlog --field=versionVerify Fix Applied:
Confirm FlightLog plugin version is 3.0.3 or later in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts for admin accounts
- Unexpected plugin file modifications
Network Indicators:
- SQL injection patterns in HTTP POST requests to /wp-admin/ or /wp-content/plugins/flightlog/
SIEM Query:
source="web_logs" AND (uri_path="/wp-admin/*" OR uri_path="/wp-content/plugins/flightlog/*") AND (http_method="POST") AND (message="*sql*" OR message="*union*" OR message="*select*" OR message="*insert*")