CVE-2015-2199

Currently unrated

Key Information:

Vendor
Wordpress
Status
Audio Player
Vendor
CVE Published:
3 March 2015

Summary

Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote administrators to execute arbitrary SQL commands via the itemid parameter in the (2) wonderplugin_audio_show_item, (3) wonderplugin_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.

References

http://security.szurek.pl/wonderplugin-audio-player-20-bl...
x_refsource_MISC
http://osvdb.org/show/osvdb/118508
vdb-entryx_refsource_OSVDB
http://www.exploit-db.com/exploits/36086
exploitx_refsource_EXPLOIT-DB

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.