Description

WordPress Plugin WP Symposium A Social Network For WordPress is prone to multiple SQL injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. WordPress Plugin WP Symposium A Social Network For WordPress version 12.06.16 is vulnerable; other versions may also be affected.

Remediation

Update to plugin version 12.06.23 or latest

References

http://ceriksen.com/2012/07/10/wordpress-symposium-plugin-multiple-sql-injection-vulnerabilities-2/

http://secunia.com/advisories/49534/

Related Vulnerabilities

WordPress Plugin Ajax Store Locator Directory Traversal (1.2.0)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Multiple Vulnerabilities (2.0.15)

JBoss Application Server Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2011-3609)

SharePoint Improper Input Validation Vulnerability (CVE-2026-63520)

WordPress Plugin Coming Soon Page & Maintenance Mode Cross-Site Scripting (1.8.1)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection CWE-89