SQL Injection Vulnerabilities in All In One WP Security & Firewall Plugin for WordPress
CVE-2014-6242

Currently unrated

Key Information:

Vendor

Wordpress
Status
All In One WordPress Security And Firewall
Vendor
CVE Published:
2 October 2014

What is CVE-2014-6242?

The All In One WP Security & Firewall plugin for WordPress has multiple SQL injection vulnerabilities that allow remote authenticated users to execute arbitrary SQL commands. Specifically, these vulnerabilities can be exploited via the 'orderby' or 'order' parameters on the aiowpsec page, accessed through wp-admin/admin.php. This weakness may also be exploited using Cross-Site Request Forgery (CSRF) techniques, enabling attackers to execute malicious SQL commands without direct interaction.

References

http://packetstormsecurity.com/files/128419/All-In-One-WP...
x_refsource_MISC
https://wordpress.org/plugins/all-in-one-wp-security-and-...
x_refsource_CONFIRM
http://www.exploit-db.com/exploits/34781
exploitx_refsource_EXPLOIT-DB

EPSS Score

5% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
The Cyber Security Vulnerability Database.