CVE-2012-4033 – Zingiri Web Shop < 2.4.0 - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2012-4033

Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors. Múltiples vulnerabilidades no especificadas en el plug-in Zingiri Web Shop antes de v2.4.0 para WordPress tienen un impacto y vectores de ataque desconocidos. The Zingiri Web Shop plugin for WordPress has multiple vulnerabilities in versions up to, and including, 2.3.7. This is due to the inclusion of timthumb.php, along with several cross-site scripting and SQL injection vulnerabilities. This makes it possible for unauthenticated attackers to access and altar data, and create administrator-level accounts. • http://forums.zingiri.com/announcements.php?aid=2 http://secunia.com/advisories/48909 http://wordpress.org/extend/plugins/zingiri-web-shop/changelog https://exchange.xforce.ibmcloud.com/vulnerabilities/75044 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •