CVE-2014-1854
HIGH
7.5
CVSS 2.0
Description
SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.
Affected products and versions
- n/a n/a — Versions not specified
References
- secunia.com http://secunia.com/advisories/57079 Vendor Advisory
- www.adrotateplugin.com http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5 Vendor Advisory
- www.exploit-db.com http://www.exploit-db.com/exploits/31834 Exploit
- www.securityfocus.com http://www.securityfocus.com/archive/1/531176/100/0/threaded
- www.securityfocus.com http://www.securityfocus.com/bid/65709
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/91253
- www.htbridge.com https://www.htbridge.com/advisory/HTB23201 Exploit
- nvd.nist.gov Official NVD record