CVE-2009-4748

2010-03-2620:30:00

CWE-89

mitre

web.nvd.nist.gov

cve-2009-4748

sql injection

vulnerability

my category order plugin

wordpress

remote execution

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.8

Confidence

Low

EPSS

0.001

Percentile

27.8%

JSON

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.

Affected configurations

Nvd

Node

andrew_charltonmy_category_orderRange≤2.8

andrew_charltonmy_category_orderMatch2.6.1

andrew_charltonmy_category_orderMatch2.6.1a

andrew_charltonmy_category_orderMatch2.7

andrew_charltonmy_category_orderMatch2.7.1

AND

wordpresswordpress

VendorProductVersionCPE
andrew_charltonmy_category_order*cpe:2.3:a:andrew_charlton:my_category_order:*:*:*:*:*:*:*:*
andrew_charltonmy_category_order2.6.1cpe:2.3:a:andrew_charlton:my_category_order:2.6.1:*:*:*:*:*:*:*
andrew_charltonmy_category_order2.6.1acpe:2.3:a:andrew_charlton:my_category_order:2.6.1a:*:*:*:*:*:*:*
andrew_charltonmy_category_order2.7cpe:2.3:a:andrew_charlton:my_category_order:2.7:*:*:*:*:*:*:*
andrew_charltonmy_category_order2.7.1cpe:2.3:a:andrew_charlton:my_category_order:2.7.1:*:*:*:*:*:*:*
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
andrew_charlton	my_category_order	*	cpe:2.3:a:andrew_charlton:my_category_order::::::::
andrew_charlton	my_category_order	2.6.1	cpe:2.3:a:andrew_charlton:my_category_order:2.6.1:::::::*
andrew_charlton	my_category_order	2.6.1a	cpe:2.3:a:andrew_charlton:my_category_order:2.6.1a:::::::*
andrew_charlton	my_category_order	2.7	cpe:2.3:a:andrew_charlton:my_category_order:2.7:::::::*
andrew_charlton	my_category_order	2.7.1	cpe:2.3:a:andrew_charlton:my_category_order:2.7.1:::::::*
wordpress	wordpress	*	cpe:2.3:a:wordpress:wordpress::::::::