CVE-2012-2109
HIGH
7.5
CVSS 2.0
Description
SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activity_widget_filter action.
Affected products and versions
- n/a n/a — Versions not specified
References
- buddypress.org http://buddypress.org/2012/03/buddypress-1-5-5/ Patch, Vendor Advisory
- osvdb.org http://osvdb.org/80763
- seclists.org http://seclists.org/bugtraq/2012/Apr/4 Exploit
- www.exploit-db.com http://www.exploit-db.com/exploits/18690 Exploit
- www.openwall.com http://www.openwall.com/lists/oss-security/2012/04/15/2 Exploit
- www.openwall.com http://www.openwall.com/lists/oss-security/2012/04/16/10
- nvd.nist.gov Official NVD record