CVE-2013-3532

Spider Video Player 2.1 - SQL Injection via Theme Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-3532. PoCs published by Ashiyane Digital Security Team.

AI-analyzed exploit summary The exploit describes an SQL injection vulnerability in the Spider Video Player WordPress plugin due to insufficient sanitization of user-supplied data in the 'theme' parameter. The issue allows attackers to manipulate SQL queries, potentially compromising the application or database.

Description

SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the theme parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Ashiyane Digital Security Team · textwebappsphp

https://www.exploit-db.com/exploits/38458

View Code ZIP pw:eip

The exploit describes an SQL injection vulnerability in the Spider Video Player WordPress plugin due to insufficient sanitization of user-supplied data in the 'theme' parameter. The issue allows attackers to manipulate SQL queries, potentially compromising the application or database.

Classification

Writeup 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Theoretical

Target: Spider Video Player plugin for WordPress 2.1

No auth needed

Prerequisites: Access to the vulnerable WordPress plugin endpoint

MITRE ATT&CK