medium6.5Public exploit code
CVE-2014-8810
SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbit…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Symposium 14.10 - SQL Injection2014-12-09 · webapps · php
Impact
SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wpsymposiumpro | Wp Symposium | through 14.10 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/62643
- http://security.szurek.pl/wp-symposium-1410-multiple-xss-and-sql-injection.html
- http://www.exploit-db.com/exploits/35505
- http://www.wpsymposium.com/2014/11/release-information-for-v14-11/
- http://secunia.com/advisories/62643
- http://security.szurek.pl/wp-symposium-1410-multiple-xss-and-sql-injection.html
- http://www.exploit-db.com/exploits/35505
- http://www.wpsymposium.com/2014/11/release-information-for-v14-11/