Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-5182. PoCs published by certuscyber.
AI-analyzed exploit summary The repository contains a functional Python-based PoC for CVE-2014-5182, demonstrating a UNION-based SQL injection in the WordPress YAWPP plugin (versions <= 1.2). The exploit authenticates to WordPress, injects a malicious SQL payload via the 'id' parameter, and exfiltrates database version information.
Description
Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SQL commands via vectors related to (1) admin_functions.php or (2) admin_update.php, as demonstrated by the id parameter in the update action to wp-admin/admin.php.
Exploits (1)
The repository contains a functional Python-based PoC for CVE-2014-5182, demonstrating a UNION-based SQL injection in the WordPress YAWPP plugin (versions <= 1.2). The exploit authenticates to WordPress, injects a malicious SQL payload via the 'id' parameter, and exfiltrates database version information.