CVE-2014-9305 Cart66 Lite :: WordPress Ecommerce < 1.5.2 - SQL Injection
MediumCVSS 6.5
EPSS 3.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a shortcode_products_table action to wp-admin/admin-ajax.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| reality66 cart66 lite | <= 1.5.1.17 | No fix listed |
| wordpress cart66-lite(WordPress) | < 1.5.2 | 1.5.2 |
References
- 115286 vdb-entry
- packetstormsecurity.com exploit
- security.szurek.pl exploit
- 35459 exploit
- wordpress.org patch vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org