CVE-2014-5183

2022-10-0316:20:43

CWE-89

[email protected]

web.nvd.nist.gov

cve-2014-5183

sql injection

simple retail menus

wordpress

remote authenticated editors

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.3 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

46.8%

JSON

SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php.

Affected configurations

NVD

Node

simple_retail_menus_plugin_projectsimple-retail-menusRange≤4.0.1wordpress

simple_retail_menus_plugin_projectsimple-retail-menusMatch4.0wordpress

CPENameOperatorVersion
simple_retail_menus_plugin_project:simple-retail-menussimple retail menus plugin project simple-retail-menusle4.0.1
simple_retail_menus_plugin_project:simple-retail-menussimple retail menus plugin project simple-retail-menuseq4.0

CPE	Name	Operator	Version
simple_retail_menus_plugin_project:simple-retail-menus	simple retail menus plugin project simple-retail-menus	le	4.0.1
simple_retail_menus_plugin_project:simple-retail-menus	simple retail menus plugin project simple-retail-menus	eq	4.0

References

codevigilant.com/disclosure/wp-plugin-simple-retail-menus-a1-injection

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=861170%40simple-retail-menus&old=728969%40simple-retail-menus&sfp_email=&sfph_mail=#file1