154 matches found
WordPress plugin AdRotate SQL注入漏洞
WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress AdRotate Plugin versions prior to 5.8.22. The vulnerability...
CVE-2022-0267: Improper Neutralization of Special Elements used in an SQL Command
The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotateaction before using it in a SQL statement via the adrotaterequestaction function available to admins, leading to a SQL injection...
AdRotate < 5.8.22 - Admin+ SQL Injection
The plugin does not sanitise and escape the adrotateaction before using it in a SQL statement via the adrotaterequestaction function available to admins, leading to a SQL injection PoC Get the nonce from one of the bulk action, for example /wp-admin/admin.php?page=adrotate and look for...
AdRotate < 5.8.22 - Admin+ SQL Injection
The plugin does not sanitise and escape the adrotateaction before using it in a SQL statement via the adrotaterequestaction function available to admins, leading to a SQL injection Get the nonce from one of the bulk action, for example /wp-admin/admin.php?page=adrotate and look for adrotatenonce ...
Wordpress AdRotate SQL Injection Vulnerability
Wordpress AdRotate is an application plugin for Wordpress. Offers to create your own ads and campaigns using HTML and/or Javascript code, or use ads from your favorite ad server. A SQL injection vulnerability exists in the AdRotate WordPress plugin prior to version 5.8.4, which stems from...
CVE-2021-24138
Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user...
CVE-2021-24138
Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user...
CVE-2021-24138
Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user...
CVE-2021-24138 AdRotate < 5.8.4 - Authenticated SQL Injection
Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user...
CVE-2021-24138
CVE-2021-24138 affects the AdRotate WordPress plugin (versions before 5.8.4). The vulnerability is an authenticated SQL injection via the id parameter caused by unvalidated input, requiring an admin user to exploit. Multiple connected sources corroborate this flaw and describe practical PoCs and ...
PT-2021-15683
Name of the Vulnerable Software and Affected Versions: AdRotate WordPress plugin versions prior to 5.8.4 Description: The issue is related to unvalidated input in the AdRotate WordPress plugin, which leads to authenticated SQL injection. This can be achieved via the id parameter and requires an...
Wordpress AdRotate SQL注入漏洞
Wordpress AdRotate is an application plugin for Wordpress. Offers to create your own ads and campaigns using HTML and/or Javascript code, or use ads from your favorite ad server. A SQL injection vulnerability exists in the AdRotate WordPress plugin prior to version 5.8.4, which stems from...
CVE-2021-24138: Improper Neutralization of Special Elements used in an SQL Command
Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user...
AdRotate < 5.8.4 - Authenticated SQL Injection
Authenticated SQL injection in the AdRotate 5.8.3.1 exists via param "id". However, this requires an admin privileged user. NOTE: The plugin author mistook this SQLi bug for XSS but the remedy remains OK. PoC Param "id" is vulneable to SQL Injeciton. Example 1:...
AdRotate < 5.8.4 - Authenticated SQL Injection
Authenticated SQL injection in the AdRotate 5.8.3.1 exists via param "id". However, this requires an admin privileged user. NOTE: The plugin author mistook this SQLi bug for XSS but the remedy remains OK. Param "id" is vulneable to SQL Injeciton. Example 1:...
WordPress AdRotate plugin <= 5.8.3 - Authenticated SQL Injection (SQLi) vulnerability
Authenticated SQL Injection SQLi vulnerability found by Nguyen Anh Tien in WordPress AdRotate plugin versions = 5.8.3. Solution Update the WordPress AdRotate plugin to the latest available version at least 5.8.4...
WordPress AdRotate Banner Manager plugin <= 5.2 - Authenticated SQL Injection (SQLi) vulnerability
Authenticated SQL Injection SQLi vulnerability found by Tin Duong in WordPress AdRotate Banner Manager plugin versions = 5.2. Solution Update the WordPress AdRotate Banner Manager plugin to the latest available version at least 5.3...
WordPress AJdG AdRotate Plugin SQL Injection Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.AJdG AdRotate plugin is an ad management plugin used in it. A SQL injection vulnerability exists in WordPress AJdG AdRotate plugin...