CVE-2015-7517

Опубликовано: 29 авг. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to (1) class-doifd-download.php or (2) class-doifd-landing-page.php in public/includes/.

Ссылки

http://permalink.gmane.org/gmane.comp.security.oss.general/18255
Third Party Advisory
http://www.securityfocus.com/bid/78220
Third Party Advisory
VDB Entry
http://www.vapidlabs.com/advisory.php?v=157
Third Party Advisory
VDB Entry
https://wpvulndb.com/vulnerabilities/8345
Third Party Advisory
VDB Entry
http://permalink.gmane.org/gmane.comp.security.oss.general/18255
Third Party Advisory
http://www.securityfocus.com/bid/78220
Third Party Advisory
VDB Entry
http://www.vapidlabs.com/advisory.php?v=157
Third Party Advisory
VDB Entry
https://wpvulndb.com/vulnerabilities/8345
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:labwebdesigns:double_opt-in_for_download:*:*:*:*:*:wordpress:*:*

Версия до 2.0.8 (включая)

EPSS

Процентиль: 88%

0.04225

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-42pg-qcjx-xrm7