Description

WordPress Plugin All-In-One Security (AIOS)-Security and Firewall is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin All-In-One Security (AIOS)-Security and Firewall version 3.9.0 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 3.9.1 or latest

References

https://www.homelab.it/index.php/2015/04/07/wordpress-all-in-one-wp-security-sql-injection-vulnerability/

http://www.exploit-db.com/exploits/36671/

http://packetstormsecurity.com/files/131317/WordPress-All-In-One-WP-Security-And-Firewall-3.9.0-SQL-Injection.html

Related Vulnerabilities

WordPress Plugin Power Zoomer Arbitrary File Upload (1.2)

WordPress Plugin Smart Forms-when you need more than just a contact form Security Bypass (2.6.84)

Liferay Portal Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2023-35030)

Dotclear Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-5690)

Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-9933)

Severity

High

Classification

CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection