Description
Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) list parameter in a move action to admin/admin_index.php, (2) display parameter in a minimize action to admin/admin_index.php, (3) enabled[] parameter to admin/admin_users.php, or (4) msg_id to the module.php in the simple_messaging module.
References (9)
Core 9
Core References
Product x_refsource_confirm
http://pligg.svn.sourceforge.net/viewvc/pligg?view=revision&revision=2461
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/75765
Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2012-19/
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/45431
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/53625
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/82050
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/82048
Various Sources x_refsource_confirm
http://forums.pligg.com/downloads.php?do=file&id=15
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/82049
Scores
EPSS
0.0245
EPSS Percentile
82.7%
Details
CWE
CWE-89
Status
published
Products (16)
pligg/pligg_cms
pligg/pligg_cms
1.0.0 (6 CPE variants)
pligg/pligg_cms
1.0.1
pligg/pligg_cms
1.0.2
pligg/pligg_cms
1.0.3
pligg/pligg_cms
1.0.4
pligg/pligg_cms
1.1.0
pligg/pligg_cms
1.1.2
pligg/pligg_cms
1.1.3
pligg/pligg_cms
1.1.4
... and 6 more
Published
May 27, 2012
Tracked Since
Feb 18, 2026