Description

WordPress Plugin WP Forum Server is prone to an SQL injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. WordPress Plugin WP Forum Server version 1.7 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.7.1 or latest

References

http://www.securityfocus.com/bid/49598/exploit

http://www.exploit-db.com/exploits/17828/

http://packetstormsecurity.com/files/view/105024/wpwpforum17-sql.txt

http://secunia.com/advisories/45974/

Related Vulnerabilities

MySQL CVE-2024-20981 Vulnerability (CVE-2024-20981)

Moodle Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-4305)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Cross-Site Scripting (3.0.17)

WordPress Plugin Nextend Google Connect Cross-Site Scripting (1.5.0)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-6296)

Severity

High

Classification

CVE-2012-6625 CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection