NVD

Id
37622  
Name
CVE-2013-1408  
Description
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2014-03-24  
Modified Date
2014-03-24  
Seq
2013-1408  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
191382 37622 CVE-2013-1408 20130206 SQL Injection Vulnerability in Wysija Newsletters WordPress Plugin  View
191383 37622 CVE-2013-1408 http://packetstormsecurity.com/files/120089/WordPress-Wysija-Newsletters-2.2-SQL-Injection.html  View
191384 37622 CVE-2013-1408 57775  View
191385 37622 CVE-2013-1408 wp-wysijanewsletters-admin-sql-injection(81932)  View
191386 37622 CVE-2013-1408 https://www.htbridge.com/advisory/HTB23140  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24675 JVNDB-2013-006250 WordPress 用 MailPoet Newsletters プラグインにおける SQL インジェクションの脆弱性 WordPress 用 MailPoet Newsletters (旧 Wysija Newsletters) プラグインには、SQL インジェクションの脆弱性が存在します。 CVE-2013-1408 61350 CVE-2013-1408 37622 6.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006250.html 2013-01-18 2014-03-26 View