CVE-2009-3703
WP Forum <= 2.3 - Multiple SQL Injections
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default URI, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default URI, related to wpf-post.php.
Múltiples vulnerabilidades de inyección SQL en el plugin WP-Forum para WordPress antes de v2.4 permiten a atacantes remotos ejecutar comandos SQL arbitrarios a través de (1) el parámetro 'search_max' en una acción de búsqueda a la URI por defecto, en relación con wpf.class.php; (2) el parámetro 'forum' a un componente no especificado, en relación con wpf.class.php; (3) el parámetro 'topic' en una acción de la vista del Foro de la URI por defecto, en relacion con la función remove_topic en wpf.class.php, o el parámetro 'id' en una acción (4) 'editpost' o (5) 'viewtopic' a la URI por defecto, en relación con wpf-post.php.
WP-Forum versions 2.3 and below suffer from remote SQL and blind SQL injection vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-09-28 CVE Published
- 2009-10-15 CVE Reserved
- 2009-12-16 First Exploit
- 2023-03-08 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/archive/1/508504/100/0/threaded | Mailing List |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/10488 | 2009-12-16 | |
| http://www.securityfocus.com/bid/37357 | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Fahlstad Search vendor "Fahlstad" | Wp-forum Search vendor "Fahlstad" for product "Wp-forum" | <= 2.2 Search vendor "Fahlstad" for product "Wp-forum" and version " <= 2.2" | - |
Affected
| in | Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | * | - |
Safe
|
| Fahlstad Search vendor "Fahlstad" | Wp-forum Search vendor "Fahlstad" for product "Wp-forum" | 1.5 Search vendor "Fahlstad" for product "Wp-forum" and version "1.5" | - |
Affected
| in | Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | * | - |
Safe
|
| Fahlstad Search vendor "Fahlstad" | Wp-forum Search vendor "Fahlstad" for product "Wp-forum" | 1.6 Search vendor "Fahlstad" for product "Wp-forum" and version "1.6" | - |
Affected
| in | Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | * | - |
Safe
|
| Fahlstad Search vendor "Fahlstad" | Wp-forum Search vendor "Fahlstad" for product "Wp-forum" | 1.7 Search vendor "Fahlstad" for product "Wp-forum" and version "1.7" | - |
Affected
| in | Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | * | - |
Safe
|
| Fahlstad Search vendor "Fahlstad" | Wp-forum Search vendor "Fahlstad" for product "Wp-forum" | 1.7.3 Search vendor "Fahlstad" for product "Wp-forum" and version "1.7.3" | - |
Affected
| in | Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | * | - |
Safe
|
| Fahlstad Search vendor "Fahlstad" | Wp-forum Search vendor "Fahlstad" for product "Wp-forum" | 1.7.4 Search vendor "Fahlstad" for product "Wp-forum" and version "1.7.4" | - |
Affected
| in | Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | * | - |
Safe
|
| Fahlstad Search vendor "Fahlstad" | Wp-forum Search vendor "Fahlstad" for product "Wp-forum" | 1.7.8 Search vendor "Fahlstad" for product "Wp-forum" and version "1.7.8" | - |
Affected
| in | Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | * | - |
Safe
|
| Fahlstad Search vendor "Fahlstad" | Wp-forum Search vendor "Fahlstad" for product "Wp-forum" | 1.8 Search vendor "Fahlstad" for product "Wp-forum" and version "1.8" | - |
Affected
| in | Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | * | - |
Safe
|
| Fahlstad Search vendor "Fahlstad" | Wp-forum Search vendor "Fahlstad" for product "Wp-forum" | 2.0 Search vendor "Fahlstad" for product "Wp-forum" and version "2.0" | - |
Affected
| in | Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | * | - |
Safe
|
| Fahlstad Search vendor "Fahlstad" | Wp-forum Search vendor "Fahlstad" for product "Wp-forum" | 2.1 Search vendor "Fahlstad" for product "Wp-forum" and version "2.1" | - |
Affected
| in | Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | * | - |
Safe
|