CVE-2021-44097
📋 TL;DR
CVE-2021-44097 is a critical SQL injection vulnerability in EGavilan Media's Contact-Form-With-Messages-Entry-Management plugin version 1.0. Attackers can exploit this via the Addmessage.php endpoint to execute arbitrary SQL commands, potentially compromising the entire application database. Organizations using this specific plugin version are affected.
💻 Affected Systems
- EGavilan Media Contact-Form-With-Messages-Entry-Management
📦 What is this software?
Contact Form With Messages Entry Management by Contact Form With Messages Entry Management Project
View all CVEs affecting Contact Form With Messages Entry Management →
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or deletion; potential privilege escalation to execute operating system commands if database permissions allow.
Likely Case
Data exfiltration from the contact form database, injection of malicious content, or denial of service by corrupting database tables.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection; database remains secure.
🎯 Exploit Status
Exploitation requires no authentication and is straightforward due to direct SQL injection in Addmessage.php.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch exists; remove or replace the vulnerable plugin version.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries in Addmessage.php to prevent SQL injection.
N/A
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests targeting Addmessage.php.
N/A
🧯 If You Can't Patch
- Disable or remove the Contact-Form-With-Messages-Entry-Management plugin version 1.0 immediately.
- Restrict network access to the application using firewalls or network segmentation to limit exposure.
🔍 How to Verify
Check if Vulnerable:
Check if the plugin version is 1.0 by reviewing the plugin files or configuration; test Addmessage.php with SQL injection payloads in a controlled environment.Check Version:
N/AVerify Fix Applied:
Verify the plugin is removed or replaced; test Addmessage.php with SQL injection payloads to confirm no database interaction occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs from Addmessage.php requests
- HTTP requests to Addmessage.php with SQL keywords (e.g., UNION, SELECT, DROP)
Network Indicators:
- HTTP POST requests to Addmessage.php with suspicious parameters containing SQL syntax
SIEM Query:
source="web_logs" AND uri="/Addmessage.php" AND (param="*UNION*" OR param="*SELECT*" OR param="*DROP*")🔗 References
- https://github.com/EGavilan-Media/Contact-Form-With-Messages-Entry-Management/issues/1
- https://medium.com/%40shubhamvpandey/cve-2021-44097-d51c11258571
- https://github.com/EGavilan-Media/Contact-Form-With-Messages-Entry-Management/issues/1
- https://medium.com/%40shubhamvpandey/cve-2021-44097-d51c11258571
