high7.5Public exploit code
CVE-2014-9173
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Google Document Embedder 2.5.16 - 'mysql_real_escpae_string' Bypass SQL Injection2014-12-03 · webapps · php
- WordPress Plugin Google Document Embedder 2.5.14 - SQL Injection2014-11-25 · webapps · php
Impact
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Google Doc Embedder Project | Google Doc Embedder | through 2.5.14 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/show/osvdb/115044
- http://security.szurek.pl/google-doc-embedder-2514-sql-injection.html
- http://www.exploit-db.com/exploits/35371
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98944
- https://plugins.trac.wordpress.org/changeset/1023572/google-document-embedder
- http://osvdb.org/show/osvdb/115044
- http://security.szurek.pl/google-doc-embedder-2514-sql-injection.html
- http://www.exploit-db.com/exploits/35371
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98944
- https://plugins.trac.wordpress.org/changeset/1023572/google-document-embedder