CVE-2009-4748 – my-category-order <= 2.8.7 - SQL Injection

https://notcve.org/view.php?id=CVE-2009-4748

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php. Vulnerabilidad de inyección SQL en mycategoryorder.php en el plugin My Category Order v2.8 y anteriores para WordPress, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro parentID en una acción act_OrderCategories sobre wp-admin/post-new.php. SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php. • https://www.exploit-db.com/exploits/9150 http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt http://www.exploit-db.com/exploits/9150 http://www.securityfocus.com/bid/35704 https://exchange.xforce.ibmcloud.com/vulnerabilities/51727 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •