WordPress WP Database Manager Plugin Multiple Security Vulnerabilities

Bugtraq ID:	70626
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 16 2014 12:00AM
Updated:	Oct 16 2014 12:00AM
Credit:	Larry W. Cashdollar
Vulnerable:
Not Vulnerable:

WordPress WP Database Manager Plugin Multiple Security Vulnerabilities

The WP Database Manager plugin for WordPress is prone to the following security vulnerabilities:

1. A command-injection vulnerability
2. Multiple information-disclosure vulnerabilities
3. An arbitrary-file-download vulnerability.

Exploiting these issues could allow an attacker to gain access to potentially sensitive information, execute arbitrary commands in the context of the affected application and to download arbitrary files.

WP Database Manager Plugin 2.7.1 is vulnerable; other versions may also be affected.

WordPress WP Database Manager Plugin Multiple Security Vulnerabilities

An attacker can exploit these issues through a browser.

WordPress WP Database Manager Plugin Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

WordPress WP Database Manager Plugin Multiple Security Vulnerabilities

References: