WP Symposium up to 15.7 on WordPress get_album_item.php size sql injection : 8/20/2015 6:08:40 AM
 | Try GlowHost for 1 Cent! Select any shared package for 1 penny. From our sponsors  |
| Vulnerability Advisories |
| Vulnerabilities of scip VulDB |
WP Symposium up to 15.7 on WordPress get_album_item.php size sql injection
8/18/2015 7:00:00 PM
General
scipID: 77345
Affected: WP Symposium up to 15.7
Published: 08/19/2015
Risk: critical
Created: 08/20/2015
Entry: 66.8% complete
Summary
A vulnerability was found in WP Symposium up to 15.7 on WordPress. It has been rated as critical. This issue affects an unknown function of the file get_album_item.php. The manipulation of the argument size with an unknown input leads to a sql injection vulnerability. Impacted is confidentiality, integrity, and availability. The summary by CVE is:
SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.
The weakness was published 08/19/2015. The identification of this vulnerability is CVE-2015-6522. The attack may be initiated remotely. Technical details are known, but no exploit is available.
By approaching the search of inurl:get_album_item.php it is possible to find vulnerable targets with Google Hacking.
Upgrading to version 15.8 eliminates this vulnerability.CVSS
Base Score: 6.0 (CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P) [?]
Temp Score: 5.2 (CVSS2#E:ND/RL:OF/RC:ND) [?]
CPE
- cpe:/a:wp_symposium:wp_symposium:15.0
- cpe:/a:wp_symposium:wp_symposium:15.1
- cpe:/a:wp_symposium:wp_symposium:15.2
- cpe:/a:wp_symposium:wp_symposium:15.3
- cpe:/a:wp_symposium:wp_symposium:15.4
- cpe:/a:wp_symposium:wp_symposium:15.5
- cpe:/a:wp_symposium:wp_symposium:15.6
- cpe:/a:wp_symposium:wp_symposium:15.7
Exploiting
Class: Sql injection
Local: No
Remote: Yes
Availability: No
Google Hack: inurl:get_album_item.php
Countermeasures
Recommended: Upgrade
Status: Official fix
0-Day Time: 0 days since found
Upgrade: WP Symposium 15.8
Timeline
08/19/2015 | Advisory disclosed
08/20/2015 | VulDB entry created
08/20/2015 | VulDB entry updated
Sources
CVE: CVE-2015-6522 (mitre.org) (nvd.nist.org) (cvedetails.com)
You are receiving this email because you subscribed to this feed at feedmyinbox.com
If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions
