VulnerabilityModified
CVE-2014-3961
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/.
HIGH 7.5EPSS 5.64%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.64%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 5.64% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- xnau/participants database
- Source
- cve@mitre.org
References
- http://osvdb.org/show/osvdb/107626
- http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.htmlExploit
- http://seclists.org/fulldisclosure/2014/Jun/0Exploit
- http://www.exploit-db.com/exploits/33613Exploit
- http://www.securityfocus.com/bid/67769
- https://wordpress.org/plugins/participants-database/changelogPatch
- https://www.yarubo.com/advisories/1Exploit, URL Repurposed
- http://osvdb.org/show/osvdb/107626
- http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.htmlExploit
- http://seclists.org/fulldisclosure/2014/Jun/0Exploit
- http://www.exploit-db.com/exploits/33613Exploit
- http://www.securityfocus.com/bid/67769
- https://wordpress.org/plugins/participants-database/changelogPatch
- https://www.yarubo.com/advisories/1Exploit, URL Repurposed
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.