PT-2015-3533 · Cardoza · Ajax Post Search

Marcela Benetrix · Publicado 2015-01-08 · Atualizado 2025-03-18 · CVE-2012-5853

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AJAX Post Search (cardoza-ajax-search) plugin versions prior to 1.3

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the srch txt parameter in a "the search text" action to the /wp-admin/admin-ajax.php API endpoint, specifically targeting the the search function function in cardoza ajax search.php.

Recommendations For versions prior to 1.3, update to version 1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the the search function function in cardoza ajax search.php until the update is applied. Avoid using the srch txt parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-5853

Produtos afetados

Ajax Post Search

Referências · 4

• 🔥 http://seclists.org/bugtraq/2012/Nov/33 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5853 · Nota de Segurança
• https://t.me/cvenotify/115142 · Publicação no Telegram
• https://wordpress.org/plugins/cardoza-ajax-search/changelog · Nota