CVE-2011-4671

Adrotate < 3.6.7 - SQL Injection

Title source: rule
STIX 2.1

Description

SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter (aka redirect URL).

Exploits (2)

exploitdb WORKING POC VERIFIED
by Miroslav Stampar · textwebappsphp
https://www.exploit-db.com/exploits/18114
exploitdb WORKING POC VERIFIED
by Miroslav Stampar · textwebappsphp
https://www.exploit-db.com/exploits/17888

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/50674
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/46814
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/18114

Scores

EPSS 0.0103
EPSS Percentile 77.4%

Details

CWE
CWE-89
Status published
Products (47)
adrotateplugin/adrotate 0.1
adrotateplugin/adrotate 0.2
adrotateplugin/adrotate 0.3
adrotateplugin/adrotate 0.4
adrotateplugin/adrotate 0.5
adrotateplugin/adrotate 0.6
adrotateplugin/adrotate 0.7
adrotateplugin/adrotate 0.7.1
adrotateplugin/adrotate 0.8
adrotateplugin/adrotate 1.0
... and 37 more
Published Dec 02, 2011
Tracked Since Feb 18, 2026