cve/2021/CVE-2021-24774.md

### [CVE-2021-24774](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24774)
![](https://img.shields.io/static/v1?label=Product&message=Check%20%26%20Log%20Email&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.0.3%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)

### Description

The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues

### POC

#### Reference
- https://wpscan.com/vulnerability/f80ef09a-d3e2-4d62-8532-f0ebe59ae110

#### Github
- https://github.com/20142995/nuclei-templates