PT-2008-2149 · WordPress · Wassup

Enter_The_Dragon · Publicado 2008-01-31 · Atualizado 2017-09-29 · CVE-2008-0520

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WassUp plugin versions 1.4 through 1.4.3 for WordPress

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the from date or to date parameter to "spy.php".

Recommendations For WassUp plugin versions 1.4 through 1.4.3, consider updating to a version that is not affected by this issue, as no specific fix is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-0520

Produtos afetados

Wassup

Referências · 7

• 🔥 https://exploit-db.com/exploits/5017 · Exploit
• http://secunia.com/advisories/28702 · Aviso do Fabricante
• http://wpwp.org/archives/warning-security-bug-in-version · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0520 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0520 · Nota de Segurança
• http://securityfocus.com/bid/27525 · Nota
• http://vupen.com/english/advisories/2008/0365 · Nota