WordPress WP-PostRatings Plugin 'month' Parameter SQL Injection Vulnerability

Bugtraq ID:	49986
Class:	Input Validation Error
CVE:	CVE-2011-4646
Remote:	Yes
Local:	No
Published:	Oct 06 2011 12:00AM
Updated:	Dec 05 2011 06:27PM
Credit:	The vendor reported this issue.
Vulnerable:	WordPress WP-PostRatings 1.61 WordPress WP-PostRatings 1.50
Not Vulnerable:	WordPress WP-PostRatings 1.62

WordPress WP-PostRatings Plugin 'month' Parameter SQL Injection Vulnerability

The WP-PostRatings plug-in for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

WP-PostRatings 1.50 and 1.61 are vulnerable; other versions may also be affected

WordPress WP-PostRatings Plugin 'month' Parameter SQL Injection Vulnerability

Attacker can exploit this issue with a browser.

WordPress WP-PostRatings Plugin 'month' Parameter SQL Injection Vulnerability

Solution:
Updates are available. Please see the references for more details.

WordPress WP-PostRatings Plugin 'month' Parameter SQL Injection Vulnerability

References:

• Wordpress Homepage (Wordpress)
  
• WP-PostRatings Homepage (WordPress)
  
• Changes in wp-postratings/trunk/wp-postratings.php [355076:430970] (WordPress)