PT-2015-3712 · WordPress · Gd Star Rating

Mallory Adams · Published 2015-01-12 · Updated 2018-03-20 · CVE-2014-2838

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GD Star Rating plugin version 19.22

Description The issue allows remote attackers to hijack the authentication of administrators for requests, potentially leading to SQL injection attacks via the s parameter in the "gd-star-rating-stats" page to "wp-admin/admin.php", or cross-site scripting (XSS) attacks. SQL injection attacks involve injecting malicious SQL code to manipulate database queries, while XSS attacks involve injecting malicious code into websites to manipulate user sessions.

Recommendations For GD Star Rating plugin version 19.22, consider disabling the plugin until a patch is available to prevent potential SQL injection and XSS attacks. Restrict access to the "gd-star-rating-stats" page in wp-admin/admin.php to minimize the risk of exploitation. Avoid using the s parameter in the affected page until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-2838

Affected Products

Gd Star Rating

References · 6

• 🔥 http://seclists.org/fulldisclosure/2014/Mar/399 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2838 · Security Note
• https://advisories.dxw.com/advisories/csrf-and-blind-sql-injection-in-gd-star-rating-1-9-22 · Note
• http://secunia.com/advisories/57667 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2838 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/92156 · Note