high7.5Public exploit code
CVE-2015-4614
Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to execute arbitrary S…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Easy2Map 1.24 - SQL Injection2015-07-08 · webapps · php
Impact
Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the mapName parameter in an e2m_img_save_map_name action to wp-admin/admin-ajax.php and other unspecified vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Easy2map Project | Easy2map | through 1.2.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2015/Jul/18
- http://www.securityfocus.com/archive/1/535922/100/0/threaded
- http://www.vapid.dhs.org/advisory.php?v=131
- https://plugins.trac.wordpress.org/changeset/1191455/easy2map
- https://wordpress.org/plugins/easy2map/changelog/
- https://www.exploit-db.com/exploits/37534/
- http://seclists.org/fulldisclosure/2015/Jul/18
- http://www.securityfocus.com/archive/1/535922/100/0/threaded
- http://www.vapid.dhs.org/advisory.php?v=131
- https://plugins.trac.wordpress.org/changeset/1191455/easy2map
- https://wordpress.org/plugins/easy2map/changelog/
- https://www.exploit-db.com/exploits/37534/