PT-2008-2149 · WordPress · Wassup

Enter_The_Dragon · Published 2008-01-31 · Updated 2017-09-29 · CVE-2008-0520

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WassUp plugin versions 1.4 through 1.4.3 for WordPress

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the from date or to date parameter to "spy.php".

Recommendations For WassUp plugin versions 1.4 through 1.4.3, consider updating to a version that is not affected by this issue, as no specific fix is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-0520

Affected Products

Wassup

References · 7

• 🔥 https://exploit-db.com/exploits/5017 · Exploit
• http://secunia.com/advisories/28702 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0520 · Security Note
• http://wpwp.org/archives/warning-security-bug-in-version · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0520 · Note
• http://securityfocus.com/bid/27525 · Note
• http://vupen.com/english/advisories/2008/0365 · Note