CVE-2013-1408
Wysija Newsletters < 2.2.1 - Authenticated SQL Injection via Search or Orderby Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-1408. PoCs published by High-Tech Bridge.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in the Wysija Newsletters WordPress plugin. The payload uses the `load_file` function to read the MySQL version and append a path, confirming the vulnerability.
Description
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Exploits (1)
This exploit demonstrates a SQL injection vulnerability in the Wysija Newsletters WordPress plugin. The payload uses the `load_file` function to read the MySQL version and append a path, confirming the vulnerability.