PT-2015-3712 · WordPress · Gd Star Rating

Mallory Adams · Publicado 2015-01-12 · Atualizado 2018-03-20 · CVE-2014-2838

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GD Star Rating plugin version 19.22

Description The issue allows remote attackers to hijack the authentication of administrators for requests, potentially leading to SQL injection attacks via the s parameter in the "gd-star-rating-stats" page to "wp-admin/admin.php", or cross-site scripting (XSS) attacks. SQL injection attacks involve injecting malicious SQL code to manipulate database queries, while XSS attacks involve injecting malicious code into websites to manipulate user sessions.

Recommendations For GD Star Rating plugin version 19.22, consider disabling the plugin until a patch is available to prevent potential SQL injection and XSS attacks. Restrict access to the "gd-star-rating-stats" page in wp-admin/admin.php to minimize the risk of exploitation. Avoid using the s parameter in the affected page until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-2838

Produtos afetados

Gd Star Rating

Referências · 6

• 🔥 http://seclists.org/fulldisclosure/2014/Mar/399 · Exploit
• https://advisories.dxw.com/advisories/csrf-and-blind-sql-injection-in-gd-star-rating-1-9-22 · Nota
• http://secunia.com/advisories/57667 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2838 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2838 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/92156 · Nota