GSD-2014-6242
Vulnerability from gsd - Updated: 2023-12-13 01:22Details
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2014-6242",
"description": "Multiple SQL injection vulnerabilities in the All In One WP Security \u0026 Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.",
"id": "GSD-2014-6242",
"references": [
"https://packetstormsecurity.com/files/cve/CVE-2014-6242"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2014-6242"
],
"details": "Multiple SQL injection vulnerabilities in the All In One WP Security \u0026 Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.",
"id": "GSD-2014-6242",
"modified": "2023-12-13T01:22:50.771936Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-6242",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in the All In One WP Security \u0026 Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.html"
},
{
"name": "https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog",
"refsource": "CONFIRM",
"url": "https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog"
},
{
"name": "34781",
"refsource": "EXPLOIT-DB",
"url": "http://www.exploit-db.com/exploits/34781"
},
{
"name": "70150",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/70150"
},
{
"name": "https://www.htbridge.com/advisory/HTB23231",
"refsource": "MISC",
"url": "https://www.htbridge.com/advisory/HTB23231"
},
{
"name": "20140924 Two SQL Injections in All In One WP Security WordPress plugin",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/533519/100/0/threaded"
},
{
"name": "allinone-wp-cve20146242-sql-injection(96204)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96204"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:tips_and_tricks_hq:all_in_one_wordpress_security_and_firewall:*:*:*:*:*:wordpress:*:*",
"cpe_name": [],
"versionEndIncluding": "3.8.2",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-6242"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in the All In One WP Security \u0026 Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.html",
"refsource": "MISC",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.html"
},
{
"name": "https://www.htbridge.com/advisory/HTB23231",
"refsource": "MISC",
"tags": [
"Exploit"
],
"url": "https://www.htbridge.com/advisory/HTB23231"
},
{
"name": "https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog"
},
{
"name": "70150",
"refsource": "BID",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/70150"
},
{
"name": "34781",
"refsource": "EXPLOIT-DB",
"tags": [
"Exploit"
],
"url": "http://www.exploit-db.com/exploits/34781"
},
{
"name": "allinone-wp-cve20146242-sql-injection(96204)",
"refsource": "XF",
"tags": [],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96204"
},
{
"name": "20140924 Two SQL Injections in All In One WP Security WordPress plugin",
"refsource": "BUGTRAQ",
"tags": [],
"url": "http://www.securityfocus.com/archive/1/533519/100/0/threaded"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2018-10-09T19:50Z",
"publishedDate": "2014-10-02T14:55Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…