PT-2019-8545 · Kama · Kama-Clic-Counter

Manuel García Cárdenas · Publicado 2019-09-13 · Atualizado 2019-09-16 · CVE-2017-18614

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions kama-clic-counter plugin version 3.4.9

Description The issue concerns SQL injection via the order parameter in the "admin.php" endpoint. This allows for potential exploitation by injecting malicious SQL code.

Recommendations For kama-clic-counter plugin version 3.4.9, avoid using the order parameter in the "admin.php" endpoint until a fix is available. Consider temporarily restricting access to the admin.php endpoint to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-18614

Produtos afetados

Kama-Clic-Counter

Referências · 4

• 🔥 https://seclists.org/fulldisclosure/2017/Feb/67 · Exploit
• https://osv.dev/vulnerability/CVE-2017-18614 · Aviso do Fabricante
• https://wordpress.org/plugins/kama-clic-counter/#developers · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-18614 · Nota de Segurança