Details of VAR-202212-2110

ID

VAR-202212-2110

CVE

CVE-2021-30134

TITLE

php-mod/curl Cross-site scripting vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-017922

DESCRIPTION

php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php. php-mod/curl Exists in a cross-site scripting vulnerability.Information may be obtained and information may be tampered with

Trust: 1.8

sources: NVD: CVE-2021-30134 // JVNDB: JVNDB-2021-017922 // VULHUB: VHN-389786 // VULMON: CVE-2021-30134

AFFECTED PRODUCTS

vendor:	teamleade	model:	teamleader crm forms	scope:	lt	version:	2.1.0	Trust: 1.0
vendor:	qiwi	model:	woo-qiwi-payment-gateway	scope:	lte	version:	0.0.9	Trust: 1.0
vendor:	ptwooplugins	model:	invoicing with invoicexpress for woocommerce	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	php curl class	model:	php curl class	scope:	lt	version:	2.3.2	Trust: 1.0
vendor:	ht slider range for amazon affiliates	model:	ht slider range for amazon affiliates	scope:	lt	version:	1.1.6	Trust: 1.0
vendor:	shopello api	model:	shopello api	scope:	lte	version:	2.9.0	Trust: 1.0
vendor:	php curl class	model:	php curl class	scope:	-	version:	-	Trust: 0.8
vendor:	shopello api	model:	shopello api	scope:	-	version:	-	Trust: 0.8
vendor:	ht slider range for amazon affiliates	model:	ht slider range for amazon affiliates	scope:	-	version:	-	Trust: 0.8
vendor:	teamleader	model:	crm forms	scope:	-	version:	-	Trust: 0.8
vendor:	qiwi open api	model:	woocommerce-payment-qiwi	scope:	-	version:	-	Trust: 0.8
vendor:	pt woo plugins	model:	invoicing with invoicexpress for woocommerce	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-017922 // NVD: CVE-2021-30134

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-30134
value:	MEDIUM
Trust: 1.0
134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2021-30134
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-30134
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202212-3889
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2021-30134
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.1
Trust: 2.0
NVD:	CVE-2021-30134
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2021-017922 // CNNVD: CNNVD-202212-3889 // NVD: CVE-2021-30134 // NVD: CVE-2021-30134

PROBLEMTYPE DATA

problemtype:	CWE-79	Trust: 1.1
problemtype:	Cross-site scripting (CWE-79) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-389786 // JVNDB: JVNDB-2021-017922 // NVD: CVE-2021-30134

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202212-3889

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202212-3889

PATCH

title:	woo-qiwi-payment-gateway	url:	https://github.com/php-curl-class/php-curl-class	Trust: 0.8
title:	WordPress Plugin php-mod/curl Fixes for cross-site scripting vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=220106	Trust: 0.6

sources: JVNDB: JVNDB-2021-017922 // CNNVD: CNNVD-202212-3889

EXTERNAL IDS

db:	NVD	id:	CVE-2021-30134	Trust: 3.4
db:	JVNDB	id:	JVNDB-2021-017922	Trust: 0.8
db:	CNNVD	id:	CNNVD-202212-3889	Trust: 0.6
db:	VULHUB	id:	VHN-389786	Trust: 0.1
db:	VULMON	id:	CVE-2021-30134	Trust: 0.1

sources: VULHUB: VHN-389786 // VULMON: CVE-2021-30134 // JVNDB: JVNDB-2021-017922 // CNNVD: CNNVD-202212-3889 // NVD: CVE-2021-30134

REFERENCES

url:	https://wpscan.com/vulnerability/0b547728-27d2-402e-ae17-90d539344ec7	Trust: 2.6
url:	https://nvd.nist.gov/vuln/detail/cve-2021-30134	Trust: 1.4
url:	https://cxsecurity.com/cveshow/cve-2021-30134/	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-389786 // VULMON: CVE-2021-30134 // JVNDB: JVNDB-2021-017922 // CNNVD: CNNVD-202212-3889 // NVD: CVE-2021-30134

SOURCES

db:	VULHUB	id:	VHN-389786
db:	VULMON	id:	CVE-2021-30134
db:	JVNDB	id:	JVNDB-2021-017922
db:	CNNVD	id:	CNNVD-202212-3889
db:	NVD	id:	CVE-2021-30134

LAST UPDATE DATE

2025-04-15T23:47:13.564000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-389786	date:	2023-01-05T00:00:00
db:	VULMON	id:	CVE-2021-30134	date:	2022-12-26T00:00:00
db:	JVNDB	id:	JVNDB-2021-017922	date:	2023-03-06T07:35:00
db:	CNNVD	id:	CNNVD-202212-3889	date:	2023-01-06T00:00:00
db:	NVD	id:	CVE-2021-30134	date:	2025-04-14T19:15:28.767

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-389786	date:	2022-12-26T00:00:00
db:	VULMON	id:	CVE-2021-30134	date:	2022-12-26T00:00:00
db:	JVNDB	id:	JVNDB-2021-017922	date:	2023-03-06T00:00:00
db:	CNNVD	id:	CNNVD-202212-3889	date:	2022-12-26T00:00:00
db:	NVD	id:	CVE-2021-30134	date:	2022-12-26T07:15:11.310