EUVD-2017-6337

Malware in sbrugna...

WordPress WPHRM plugin <= 1.0 - Authenticated SQL Injection

WordPress WPHRM plugin Authenticated SQL Injection allows an attacker to inject SQL commands via the employeeid $GET param. Solution Update the plugin...

CVE-2017-14848

WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employeeid parameter...

CVE-2017-14848: Improper Neutralization of Special Elements used in an SQL Command

WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employeeid parameter...

CVE-2017-14848

WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employeeid parameter...

CVE-2017-14848

The CVE-2017-14848 entry corresponds to the WordPress WPHRM plugin (WordPress) vulnerability: authenticated SQL injection via the employee_id parameter, affecting version 1.0 and earlier. Technical details across connected sources confirm the issue arises from unsafely handling the employee_id in...

WordPress WPHRM Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Plugin WPHRM - SQL Injection Dork: N/A Date: 29.09.2017 Vendor Homepage: http://mojoomla.com/ Software Link: https://codecanyon.net/item/wphrm-human-resource-management-system-for-wordpress/20555857 Demo:...

PT-2017-13725

Name of the Vulnerable Software and Affected Versions WPHRM Human Resource Management System for WordPress version 1.0 Description The issue allows SQL Injection via the employee id parameter. Recommendations For WPHRM Human Resource Management System for WordPress version 1.0, avoid using the...

WordPress Plugin WPHRM - SQL Injection

WordPress Plugin WPHRM - SQL Injection Exploit Title: WordPress Plugin WPHRM - SQL Injection Dork: N/A Date: 29.09.2017 Vendor Homepage: http://mojoomla.com/ Software Link: https://codecanyon.net/item/wphrm-human-resource-management-system-for-wordpress/20555857 Demo:...

WordPress Plugin WPHRM - SQL Injection

Exploit Title: WordPress Plugin WPHRM - SQL Injection Dork: N/A Date: 29.09.2017 Vendor Homepage: http://mojoomla.com/ Software Link: https://codecanyon.net/item/wphrm-human-resource-management-system-for-wordpress/20555857 Demo: http://mobilewebs.net/mojoomla/extend/wordpress/wphrm/ Version: N/A...

WPHRM <= 1.0 - Authenticated SQL Injection

The vulnerability allows an employee users to inject SQL commands. http://localhost/PATH/?hr-dashboard=user&page=message&tab=viewmessage&from=inbox&id=SQL-23+union+select 1,2,3,4,5,SELECT+GROUPCONCATtablename+SEPARATOR+0x3c62723e+FROM+INFORMATIONSCHEMA.TABLES+WHERE+TABLESCHEMA=DATABASE,7,8--%20-...

WPHRM <= 1.0 - Authenticated SQL Injection

The vulnerability allows an employee users to inject SQL commands. PoC http://localhost/PATH/?hr-dashboard=user=message=viewmessage=inbox=SQL-23+union+select 1,2,3,4,5,SELECT+GROUPCONCATtablename+SEPARATOR+0x3c62723e+FROM+INFORMATIONSCHEMA.TABLES+WHERE+TABLESCHEMA=DATABASE,7,8--%20-...