NetSight
IP …
medium6.5Public exploit code

CVE-2013-1408

Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitra…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.

Affected products

VendorProductAffected versions
Wysija Newsletters ProjectWysija Newsletters
through 2.2
Versions 2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4

Weakness classification

CWE-89

References