CVE-2017-1002010

CRITICAL 9.8 CVSS 3.0

Published: September 14, 2017
Last modified: June 17, 2026
NVD status: Modified
Reported by: larry0@me.com
Weakness: CWE-89
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function.

Affected products and versions

ontraport Membership Simplified — From unspecified (including) to 1.58 (excluding)
ontraport membership_simplified — Version 1.58

References

membership.officeautopilot.com http://membership.officeautopilot.com/get-it-now/ Not Applicable
www.vapidlabs.com http://www.vapidlabs.com/advisory.php?v=188 Exploit, Patch, Third Party Advisory
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References