WP Job Board <= 4.4.4 - SQL Injection

2018-01-06 00:00
Vulnerability Lab

Strategic Overview

Status
Patched in 4.5
Affected PluginWP Job Board
Affected Version< 4.5
CVSS7.2High
CVECVE-2018-5695
View all WP Job Board vulnerabilities

Vulnerability Overview

The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php.

Technical Analysis

REMEDIATION: Update to version 4.5, or a newer patched version --- IDENTIFIER: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

External References

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C