Description

WordPress Plugin HDW Player (Video Player & Video Gallery) is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin HDW Player (Video Player & Video Gallery) version 2.4.2 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 3.0 or latest

References

https://codevigilant.com/disclosure/wp-plugin-hdw-player-video-player-video-gallery-a1-injection/

Related Vulnerabilities

Serendipity Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2012-2762)

osCommerce Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2002-1991)

WordPress Plugin Slideshow Pro Arbitrary File Upload (2.4)

WordPress Plugin SEO Redirection-301 Redirect Manager Cross-Site Scripting (6.3)

Apache HTTP Server Improper Validation of Specified Quantity in Input Vulnerability (CVE-2023-38709)

Severity

High

Classification

CVE-2014-5180 CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection