PT-2015-3713 · WordPress · Gd Star Rating

Mallory Adams · Published 2015-01-12 · Updated 2018-03-20 · CVE-2014-2839

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GD Star Rating plugin version 19.22

Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved by exploiting the s parameter in the "gd-star-rating-stats" page to "wp-admin/admin.php".

Recommendations For GD Star Rating plugin version 19.22, update to a version that contains a fix for this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-2839

Affected Products

Gd Star Rating

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-2839 · Security Note
• http://seclists.org/fulldisclosure/2014/Mar/399 · Note
• https://advisories.dxw.com/advisories/csrf-and-blind-sql-injection-in-gd-star-rating-1-9-22 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2839 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/92156 · Note