PT-2019-7424 · WordPress · Yet Another Stars Rating
Marcin Probola
·
Publicado
2019-10-10
·
Atualizado
2019-10-15
·
CVE-2015-9465
CVSS v2.0
6.5
Média
| Vetor | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
yet-another-stars-rating plugin versions prior to 0.9.1
Description
The issue is related to SQL injection via the
set id parameter in the yasr get multi set values and field function. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents.Recommendations
For versions prior to 0.9.1, update to version 0.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the
yasr get multi set values and field function or avoiding the use of the set id parameter until the update is applied.Exploit
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Yet Another Stars Rating