CVE-2015-4066

Опубликовано: 27 мая 2015

Источник: nvd

CVSS2: 6.5

EPSS Низкий

Описание

Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to wp-admin/admin.php.

Ссылки

http://packetstormsecurity.com/files/132036/WordPress-GigPress-2.3.8-SQL-Injection.html
Exploit
http://www.securityfocus.com/bid/74747
https://wordpress.org/plugins/gigpress/changelog/
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/37109/
Exploit
http://packetstormsecurity.com/files/132036/WordPress-GigPress-2.3.8-SQL-Injection.html
Exploit
http://www.securityfocus.com/bid/74747
https://wordpress.org/plugins/gigpress/changelog/
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/37109/
Exploit

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:tri:gigpress:*:*:*:*:*:wordpress:*:*

Версия до 2.3.8 (включая)

EPSS

Процентиль: 85%

0.02669

Низкий

6.5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-4394-5727-8668

github

больше 3 лет назад