SEO SearchTerms Tagging 2 <=1.535 - SQL Injection

2015-07-08 00:00
Marcin Probola

Strategic Overview

Status
Unpatched
Affected Version<= 1.535
CVSS7.2High
CVECVE-2015-9458
View all SEO SearchTerms Tagging 2 vulnerabilities

Vulnerability Overview

The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploitable via CSRF.

Technical Analysis

REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

External References

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C