CVEvulnerability
CVE-2009-4748
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2010-03-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.
Affected configurations
• andrew charlton my category order (<= 2.8)
• andrew charlton my category order 2.6.1
• andrew charlton my category order 2.6.1a
• andrew charlton my category order 2.7
• andrew charlton my category order 2.7.1
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt packetstormsecurity.org
- http://www.exploit-db.com/exploits/9150 www.exploit-db.com
- http://www.securityfocus.com/bid/35704 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51727 exchange.xforce.ibmcloud.com
- http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt packetstormsecurity.org
- http://www.exploit-db.com/exploits/9150 www.exploit-db.com
- http://www.securityfocus.com/bid/35704 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51727 exchange.xforce.ibmcloud.com