CVE-2015-2824
Simple Ads Manager < 2.7.97 - SQL Injection via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2015-2824. PoCs published by ITAS Team.
AI-analyzed exploit summary This exploit demonstrates multiple SQL injection vulnerabilities in the WordPress plugin Simple Ads Manager (versions 2.5.94 and 2.5.96). The PoC includes detailed HTTP requests and vulnerable code snippets showing how user-controlled input is directly interpolated into SQL queries without proper sanitization.
Description
Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitrary SQL commands via a (1) hits[][] parameter in a sam_hits action to sam-ajax.php; the (2) cstr parameter in a load_posts action to sam-ajax-admin.php; the (3) searchTerm parameter in a load_combo_data action to sam-ajax-admin.php; or the (4) subscriber, (5) contributor, (6) author, (7) editor, (8) admin, or (9) sadmin parameter in a load_users action to sam-ajax-admin.php.
Exploits (1)
This exploit demonstrates multiple SQL injection vulnerabilities in the WordPress plugin Simple Ads Manager (versions 2.5.94 and 2.5.96). The PoC includes detailed HTTP requests and vulnerable code snippets showing how user-controlled input is directly interpolated into SQL queries without proper sanitization.