WordPress zm-gallery plugin 1.0 SQL Injection

zm-gallery plugin 1.0 for WordPress is susceptible to SQL injection via the order parameter. id: CVE-2016-10940 info: name: WordPress zm-gallery plugin 1.0 SQL Injection author: cckuailong,daffainfo severity: high description: zm-gallery plugin 1.0 for WordPress is susceptible to SQL injection vi...

CVE-2016-10940

The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter...

WordPress zm-gallery plugin SQL injection vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in version 1.0 of the WordPress zm-gallery plugin. The vulnerability stem...

CVE-2016-10940

The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter...

CVE-2016-10940

The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter...

Sql injection

The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter...

CVE-2016-10940

The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter...

CVE-2016-10940

CVE-2016-10940 refers to the WordPress plug‑in zm-gallery 1.0, which is vulnerable to SQL injection through the order parameter. The Nuclei template and related sources describe the condition as a SQL injection that could allow an attacker to execute arbitrary SQL commands, potentially exposing o...

WordPress ZM Gallery Plugin <= 1.0 - Blind SQL Injection

This plugin is prone to an SQL injection vulnerability. It allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress ZM Gallery Plugin <= 1.0 - Blind SQL Injection

This plugin is prone to an SQL injection vulnerability. It allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

ZM Gallery 1.0 – Authenticated Blind SQL Injection

The plugin is still affected and has been closed. Type user access: admin user. $GET‘order’ is escaped wrong. Attack with Blind Injection PoC python sqlmap.py -u "http://www.example.com/wp-admin/admin.php?page=zmgallery=name=desc" --dbs --cookie="cookie of admin user" --level=5 --dbms=mysql...