CVE-2015-5533 Count per Day <= 3.4 - Cross-Site Request Forgery
HighCVSS 7.2
EPSS 7.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the cpd_keep_month parameter to wp-admin/options-general.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| count per day project count per day | <= 3.4 | No fix listed |
| wordpress count-per-day(WordPress) | < 3.4.1 | 3.4.1 |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 20150722 SQL Injection in Count Per Day WordPress Plugin mailing-list
- plugins.trac.wordpress.org issue-tracking
- wpvulndb.com third-party-advisory
- 37707 exploit third-party-advisory vdb-entry
- www.htbridge.com third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org