CVE-2013-5673 Testimonial < 2.3 - SQL Injection
HighCVSS 7.5
EPSS 6.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the custom_query parameter in a testimonial_add action to wp-admin/admin-ajax.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| indianic testimonial plugin | = 2.2 | No fix listed |
| wordpress indianic-testimonial(WordPress) | < 2.3 | 2.3 |
References
- 20130901 IndiaNIC Testimonail WP plugin - Multiple vulnerabilities exploit mailing-list
- 96793 vdb-entry
- packetstormsecurity.com exploit
- 20130901 IndiaNIC Testimonial WP plugin - Multiple vulnerabilities exploit mailing-list
- [oss-security] 20130901 Re: [CVE Request] IndiaNIC Testimonial 2.2 WP plugin exploit mailing-list
- 28054 exploit
- 62108 exploit vdb-entry
- indianictestimon-cve20135673-sql-injection(86847) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org