CVE-2014-8336

MEDIUM

WP-DBManager < 2.7.1 - Arbitrary File Read via SQL LOAD_FILE in Run Query Panel

Title source: llm

Description

The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT statement.

References (5)

Core 5

Core References

Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

https://github.com/lesterchan/wp-dbmanager/commit/7037fa8f61644098044379190d1d4bf1883b8e4a

Exploit, Third Party Advisory x_refsource_misc

http://www.vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.html

Issue Tracking, Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/97694

Third Party Advisory x_refsource_confirm

https://wordpress.org/plugins/wp-dbmanager/#developers

Issue Tracking, Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2014/10/21/3

Scores

CVSS v3 6.5

EPSS 0.0260

EPSS Percentile 83.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-20

Status published

Products (1)

wp-dbmanager_project/wp-dbmanager < 2.7.1

Published Jan 05, 2018

Tracked Since Feb 18, 2026