CVE-2016-0769 eShop <= 6.3.14 - Multiple SQL Injections
HighCVSS 8.8
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elfden eshop plugin | = 6.3.14 | No fix listed |
| wordpress eshop(WordPress) | <= 6.3.14 | No fix listed |
References
- [oss-security] 20160202 Reflected XSS & Blind SQLi in wordpress plugin eshop v6.3.14 exploit mailing-list third-party-advisory
- 82347 third-party-advisory vdb-entry
- www.vapid.dhs.org exploit third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org