CVE-2008-0520

2008-01-3120:00:00

CWE-89

mitre

web.nvd.nist.gov

sql injection

wassup plugin

wordpress

cve-2008-0520

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.6

Confidence

Low

EPSS

0.002

Percentile

61.8%

JSON

Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php.

Affected configurations

Nvd

Node

wordpresswassup_pluginRange≤1.4.3

wordpresswassup_pluginMatch1.4

VendorProductVersionCPE
wordpresswassup_plugin*cpe:2.3:a:wordpress:wassup_plugin:*:*:*:*:*:*:*:*
wordpresswassup_plugin1.4cpe:2.3:a:wordpress:wassup_plugin:1.4:*:*:*:*:*:*:*