WordPress CVEs

Description

SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/.

Affected WordPress components

• Participants Database Plugin · participants-database
  Confirmed match Active
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• xnau participants_database — Up to and including 1.5.4.8
• xnau participants_database — Version 1.5.4
• xnau participants_database — Version 1.5.4.1
• xnau participants_database — Version 1.5.4.2
• xnau participants_database — Version 1.5.4.3
• xnau participants_database — Version 1.5.4.4
• xnau participants_database — Version 1.5.4.5
• xnau participants_database — Version 1.5.4.6
• xnau participants_database — Version 1.5.4.7

References

• osvdb.org http://osvdb.org/show/osvdb/107626
• packetstormsecurity.com http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.html Exploit
• seclists.org http://seclists.org/fulldisclosure/2014/Jun/0 Exploit
• www.exploit-db.com http://www.exploit-db.com/exploits/33613 Exploit
• www.securityfocus.com http://www.securityfocus.com/bid/67769
• wordpress.org https://wordpress.org/plugins/participants-database/changelog Patch
• www.yarubo.com https://www.yarubo.com/advisories/1 Exploit, URL Repurposed
• nvd.nist.gov Official NVD record