SQL Injection Vulnerability in Gallery Objects Plugin for WordPress
CVE-2014-5201

Currently unrated

Key Information:

Vendor

Wordpress
Status
Gallery Objects
Vendor
CVE Published:
12 August 2014

What is CVE-2014-5201?

The Gallery Objects plugin version 0.4 for WordPress is subject to an SQL injection vulnerability that enables remote attackers to execute arbitrary SQL commands. This breach occurs through the manipulation of the 'viewid' parameter during the 'go_view_object' action, specifically targeting wp-admin/admin-ajax.php. This flaw poses significant risks to the security of affected WordPress sites, allowing unauthorized access to sensitive database information.

References

http://packetstormsecurity.com/files/127533/WordPress-Gal...
x_refsource_MISC
http://www.homelab.it/index.php/2014/07/18/wordpress-gall...
x_refsource_MISC
http://www.securityfocus.com/bid/68791
vdb-entryx_refsource_BID

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.