CVE-2014-9178 SP Project & Document Manager < 2.4.4 - Multiple SQL Injection
HighCVSS 7.5
EPSS 4.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter in the email_vendor function or id parameter in the (2) download_project, (3) download_archive, or (4) remove_cat function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| smartypantsplugins sp project document manager | <= 2.4.1 | No fix listed |
| wordpress sp-client-document-manager(WordPress) | < 2.4.4 | 2.4.4 |
References
- packetstormsecurity.com exploit
- 35313 exploit
- www.itas.vn
- 20141121 Multiple SQL Injection in SP Client Document Manager plugin mailing-list
- wp-spclient-sql-injection(98897) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org