Vulnerability record · CVE-2021-24741 · published 20 September 2021
CVE-2021-24741: Schiocco support board - chat and help desk sql injection vulnerability
Schiocco · Support Board Chat And Help Desk
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
Description
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://board.support/changes | Release NotesVendor Advisory |
| https://medium.com/%40lijohnjefferson/multiple-sql-injection-unauthenticated-in-support-board-v-3-3-3-3e9b4214a4f9 | |
| https://wpscan.com/vulnerability/ccf293ec-7607-412b-b662-5e237b8690ca | ExploitThird Party Advisory |
| https://board.support/changes | Release NotesVendor Advisory |
| https://medium.com/%40lijohnjefferson/multiple-sql-injection-unauthenticated-in-support-board-v-3-3-3-3e9b4214a4f9 | |
| https://wpscan.com/vulnerability/ccf293ec-7607-412b-b662-5e237b8690ca | ExploitThird Party Advisory |
Track CVE-2021-24741 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-24741), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
