CVE-2015-4062

Nuclei

WordPress Plugin NewStatPress 0.9.8 - Multiple Vulnerabilities

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2015-4062 has a selected CVSS score of 6.5; EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin NewStatPress 0.9.8 - Multiple VulnerabilitiesExploitDB exploitby Adrián M. F.Not analyzed1 file

linked to 2 vulnerabilities

ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress NewStatPress 0.9.8 - SQL InjectionCVSS 6.5

WordPress NewStatPress 0.9.8 plugin contains a SQL injection vulnerability in includes/nsp_search.php. A remote authenticated user can execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.

Remediation

Update to plugin version 0.9.9 or latest.

WeaknessesCWE-89
Authorsr3Y3r53
Template tagstime-based-sqlicve2015cveauthenticatedsqliwp-pluginnewstatpresspacketstormwordpresswpnewstatpress_projectvuln
CVSS vector: CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:P
CPE: cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*
https://packetstormsecurity.com/files/132038/ https://wordpress.org/plugins/newstatpress http://packetstormsecurity.com/files/132038/WordPress-NewStatPress-0.9.8-Cross-Site-Scripting-SQL-Injection.html https://nvd.nist.gov/vuln/detail/CVE-2015-4062 https://wordpress.org/plugins/newstatpress/changelog/

Source: ProjectDiscovery

References

5