Unscored severity · published Aug 6, 2014
CVE-2014-5182
Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SQL commands via…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SQL commands via vectors related to (1) admin_functions.php or (2) admin_update.php, as demonstrated by the id parameter in the update action to wp-admin/admin.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YA
Yawpp · Ostenta
1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5182
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5182
Exploit
http://codevigilant.com/disclosure/wp-plugin-yawpp-a1-injection
Patch
http://wordpress.org/plugins/yawpp/changelog/
Exploit
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=834445%40yawpp&old=824042%40yawpp&sfp_email=&sfph_mail=#file36
More from Yawpp
6.1
CVE-2015-9391
The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter