Code Execution and FPD vulnerabilities in Simple:Press Forum for WordPress

Hello 3APA3A! I want to warn you about multiple security vulnerabilities in plugin Simple:Press Forum for WordPress. These are Code Execution and Full path disclosure vulnerabilities. Code Execution WASC-31: Execution of arbitrary code is possible via TinyBrowser. As I already told concerning...

Simple:Press Plugin for WordPress 'value' parameter SQL Injection

The version of the Simple:Press plugin for WordPress installed on the remote host fails to properly sanitize user-supplied input to the 'value' parameter of the 'sf-header-forum.php' script. An unauthenticated, remote attacker can leverage this issue to launch a SQL injection attack against the...

WordPress Simple:Press 4.3插件value参数SQL注入漏洞

BUGTRAQ ID: 41348 WordPress是一款免费的论坛Blog系统。 WordPress所使用的Simple:Press插件没有正确地过滤用户在搜索字段所输入的搜索变量便注入到了SQL查询中使用： sf-header-forum.php ---snip--- 385 Add Search Vars 386 ifisset$GET'search' 387 388 if$GET'search' != '' $sfvars'searchpage' = sfescint$GET'search'; 389 ifisset$GET'value' ?...

WordPress Plugin Simple:Press 4.3.0 - SQL Injection

WordPress Plugin Simple:Press 4.3.0 - SQL Injection Title: Simple:Press Wordpress Plugin SQL Injection Vulnerability Author: ADEO Security Published: 03/07/2010 Version: v4.3.0 Possible all versions Vendor: http://simple-press.com Download: http://simple-press.com/download-manager.php?id=228...

WordPress Simple:Press Plugin 4.3.0 - SQL Injection Vulnerability

This Simple:Press plugin is completely integrated and fully scaleable forum plugin for WordPress. Vulnerability in this plugin is that there search values are not filtered and inserted into SQL queries without using any quotes. And it is executed by Simple:Press. Solution Update the plugin...

Simple:Press Wordpress Plugin SQL Injection Vulnerability

Exploit for php platform in category web applications ========================================================= Simple:Press Wordpress Plugin SQL Injection Vulnerability ========================================================= Title: Simple:Press Wordpress Plugin SQL Injection Vulnerability...

WordPress Plugin Simple:Press 4.3.0 - SQL Injection

Title: Simple:Press Wordpress Plugin SQL Injection Vulnerability Author: ADEO Security Published: 03/07/2010 Version: v4.3.0 Possible all versions Vendor: http://simple-press.com Download: http://simple-press.com/download-manager.php?id=228 Description: "Simple:Press – the feature rich, completel...