SQL-injection in WordPress All Video Gallery

Posted: November 9, 2012 in Vulnerabilities
Tags: , , ,
0

Wordpress Vulnerability

SQL-injection in All Video Gallery

Vulnerability: SQL-injection in WordPress All Video Gallery

Danger: High
Patch: Yes

Vector operation: Remote
Impact: Unauthorized change

Affected products: WordPress All Video Gallery Plugin 1.x

Affected versions: WordPress All Video Gallery 1.1 versions prior to 11.02.2012, possibly earlier.

Description:

The vulnerability allows a remote user to execute arbitrary SQL commands in the application database.

The vulnerability is caused due to insufficient input validation in the parameter “vid” in the scenarios and wp-content/plugins/all-video-gallery/playlist.php wp-content/plugins/all-video-gallery/xml/playlist.php. This can be exploited to execute arbitrary SQL commands in the application database.

Manufacturer URL: http://wordpress.org/extend/plugins/all-video-gallery/

Solution: Update to version 1.1, which was published after 11/01/2012 from the manufacturer.

Leave a Reply

Fill in your details below or click an icon to log in:

Gravatar
WordPress.com Logo

You are commenting using your WordPress.com account. ( Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. ( Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. ( Log Out /  Change )

Cancel

Connecting to %s