header-logo
Suggest Exploit
vendor:
Auctions plug-in for WordPress
by:
9.8
CVSS
CRITICAL
SQL Injection
89
CWE
Product Name: Auctions plug-in for WordPress
Affected Version From: 1.8.2008
Affected Version To: 1.8.2008
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested: WordPress

Auctions plug-in for WordPress SQL Injection Vulnerability

The Auctions plug-in for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Mitigation:

To mitigate this vulnerability, it is recommended to update to a patched version of the plug-in or disable it if not in use.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/49625/info

Auctions plug-in for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Owen Cutajar Auctions versions 1.8.8 and prior are vulnerable. 

http://www.example.com/wp-content/plugins/paid-downloads/download.php?download_key=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

Navigation

Suggest Exploit

Services By CQR