Description

WordPress Plugin Comment Rating is prone to an SQL injection and a security bypass weakness vulnerabilities. Exploiting these issues could allow an attacker to bypass certain security restrictions and submit multiple votes for a comment or to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin Comment Rating version 2.9.32 is vulnerable; other versions may also be affected.

Remediation

Disable the plugin

References

http://www.exploit-db.com/exploits/24552/

http://packetstormsecurity.com/files/120569/WordPress-Comment-Rating-2.9.32-SQL-Injection-Bypass.html

http://secunia.com/advisories/52348/

Related Vulnerabilities

WordPress Plugin IMPress for IDX Broker Cross-Site Scripting (3.0.5)

PrestaShop Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2018-20717)

Prototype CVE-2008-7220 Vulnerability (CVE-2008-7220)

WordPress Plugin JSM file_get_contents() Shortcode Server-Side Request Forgery (2.7.0)

Oracle Application Server CVE-2008-3987 Vulnerability (CVE-2008-3987)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass SQL Injection CWE-89 CWE-264