CVE-2014-9442 Cart66 Lite :: WordPress Ecommerce <= 1.5.3 - SQL Injection
MediumCVSS 6.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| reality66 cart66 lite | = 1.5.3 | No fix listed |
| wordpress cart66-lite(WordPress) | < 1.5.4 | 1.5.4 |
References
- 61942 third-party-advisory
- plugins.trac.wordpress.org
- research.g0blin.co.uk exploit
- wordpress.org patch vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org