Description
WordPress Plugin oQey Gallery is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Successful exploitation requires that "magic_quotes" directive is set to "Off". WordPress Plugin oQey Gallery version 0.4.8 is vulnerable; prior versions may also be affected.
Remediation
Update to the latest version
References
http://www.securityfocus.com/bid/49451/exploit
http://www.exploit-db.com/exploits/17779/
http://packetstormsecurity.com/files/view/104792/wpoqey048-sql.txt
Related Vulnerabilities
WordPress Plugin The Events Calendar:Eventbrite Tickets Cross-Site Scripting (3.9.6)
WordPress Plugin Pixabay Images Multiple Vulnerabilities (2.3)
Undertow Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2017-2670)
WordPress Plugin Woody ad snippets-Insert Header Footer Code, AdSense Ads PHP Code Injection (1.3)
WordPress Plugin WP-Forum Multiple SQL Injection Vulnerabilities (2.3)