SQL-injection in WordPress Hitasoft FLV Player

Posted: November 21, 2012 in Vulnerabilities
Tags: , ,

Wordpress Vulnerability

SQL-injection in WordPress

Vulnerability: SQL-injection in WordPress Hitasoft FLV Player

Danger: Medium
Number of vulnerabilities: 1

Vector of operation: Remote
Impact: Unauthorized change

Affected products: WordPress Hitasoft FLV Player Plugin 1.x

Affected versions: WordPress Hitasoft FLV Player 1.1, maybe earlier.

Description:

The vulnerability allows a remote user to execute arbitrary SQL commands in the application database.

The vulnerability is caused due to insufficient input validation in the “id” parameter in the script wp-content/plugins/hitasoft_player/config.php. This can be exploited to execute arbitrary SQL commands in the application database.

Manufacturer URL: http://hitasoft.com/

Solution: The way to eliminate the vulnerability does not exist at present.

links:

http://dl.packetstormsecurity.net/1211-exploits/wphitasoft-sql.txt

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s