GD Star Rating 'admin.php' Multiple Security Vulnerabilities

Bugtraq ID:	66532
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 28 2014 12:00AM
Updated:	Mar 28 2014 12:00AM
Credit:	Tom Adams
Vulnerable:	WordPress GD Star Rating 1.9.22
Not Vulnerable:

GD Star Rating 'admin.php' Multiple Security Vulnerabilities

GD Star Rating is prone to the following security vulnerabilities:

1. An SQL-injection vulnerability
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability

Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, compromise the application, access or modify data or exploit latent vulnerabilities in the underlying database,

GD Star Rating 1.9.22 is vulnerable; other versions are also affected.

GD Star Rating 'admin.php' Multiple Security Vulnerabilities

An attacker can exploit these issues through a browser. An attacker must trick an unsuspecting victim into following a malicious URI to exploit the cross-site scripting and cross-site request forgery issues.

GD Star Rating 'admin.php' Multiple Security Vulnerabilities

References:

• GD Star Rating Homepage (WordPress)