CVE-2008-0520 WassUp Real Time Analytics 1.4 - 1.4.3 - SQL Injection
HighCVSS 7.5
EPSS 2.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress wassup plugin | <= 1.4.3 | No fix listed |
| wordpress wassup plugin | = 1.4 | No fix listed |
| wordpress wassup(WordPress) | >= 1.4, < 1.4.4 | 1.4.4 |
References
- 28702 third-party-advisory vendor-advisory
- 27525 vdb-entry
- ADV-2008-0365 vdb-entry
- www.wpwp.org
- 5017 exploit
- Wordfence Intelligence third-party-advisory
- www.cve.org