WordPress Poll Plugin 'wp-admin/admin-ajax.php' Script Multiple SQL Injection Vulnerabilities
BID:56249
Info
WordPress Poll Plugin 'wp-admin/admin-ajax.php' Script Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 56249 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 25 2012 12:00AM |
| Updated: | Oct 25 2012 12:00AM |
| Credit: | Ryan Satterfield |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
WordPress Poll Plugin 'wp-admin/admin-ajax.php' Script Multiple SQL Injection Vulnerabilities
The Poll Plugin for WordPress is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Poll 33.5 is vulnerable; other versions may also be affected.
The Poll Plugin for WordPress is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Poll 33.5 is vulnerable; other versions may also be affected.
Exploit / POC
WordPress Poll Plugin 'wp-admin/admin-ajax.php' Script Multiple SQL Injection Vulnerabilities
An attacker can exploit this issue using a browser.
An attacker can exploit this issue using a browser.
Solution / Fix
WordPress Poll Plugin 'wp-admin/admin-ajax.php' Script Multiple SQL Injection Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
WordPress Poll Plugin 'wp-admin/admin-ajax.php' Script Multiple SQL Injection Vulnerabilities
References:
References: