CVE-2014-6242
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to…
Does this matter?
Lower severity and a low EPSS score (4.15%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 4.15% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- tips and tricks hq/all in one wordpress security and firewall
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.htmlExploit
- http://www.exploit-db.com/exploits/34781Exploit
- http://www.securityfocus.com/archive/1/533519/100/0/threaded
- http://www.securityfocus.com/bid/70150Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96204
- https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelogVendor Advisory
- https://www.htbridge.com/advisory/HTB23231Exploit
- http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.htmlExploit
- http://www.exploit-db.com/exploits/34781Exploit
- http://www.securityfocus.com/archive/1/533519/100/0/threaded
- http://www.securityfocus.com/bid/70150Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96204
- https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelogVendor Advisory
- https://www.htbridge.com/advisory/HTB23231Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.