PT-2015-3533 · Cardoza · Ajax Post Search

Marcela Benetrix · Published 2015-01-08 · Updated 2025-03-18 · CVE-2012-5853

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AJAX Post Search (cardoza-ajax-search) plugin versions prior to 1.3

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the srch txt parameter in a "the search text" action to the /wp-admin/admin-ajax.php API endpoint, specifically targeting the the search function function in cardoza ajax search.php.

Recommendations For versions prior to 1.3, update to version 1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the the search function function in cardoza ajax search.php until the update is applied. Avoid using the srch txt parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2012-5853

Affected Products

Ajax Post Search

References · 4

• 🔥 http://seclists.org/bugtraq/2012/Nov/33 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5853 · Security Note
• https://t.me/cvenotify/115142 · Telegram Post
• https://wordpress.org/plugins/cardoza-ajax-search/changelog · Note