SQL Injection Vulnerability in Jetpack Plugin by WordPress
CVE-2011-4673

Currently unrated

Key Information:

Vendor

Wordpress
Status
Jetpack
Vendor
CVE Published:
2 December 2011

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2011-4673?

The Jetpack plugin for WordPress contains an SQL injection vulnerability in the modules/sharedaddy.php file. This flaw permits remote attackers to craft specific requests, allowing them to execute arbitrary SQL queries through the 'id' parameter. Successful exploitation can lead to unauthorized access to sensitive data and manipulation of the database, compromising the integrity and confidentiality of the affected website.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2011-4673 - Proof of Concept

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/71404
vdb-entryx_refsource_XF
http://www.exploit-db.com/exploits/18126
exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/50730
vdb-entryx_refsource_BID

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.