CVEvulnerability
CVE-2014-1854
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-02-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.
Affected configurations
• adrotateplugin adrotate 3.9.
• adrotateplugin adrotate 3.9.1
• adrotateplugin adrotate 3.9.2
• adrotateplugin adrotate 3.9.3
• adrotateplugin adrotate 3.9.4
• adrotateplugin adrotate 3.9.5
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://secunia.com/advisories/57079 Vendor Advisory
- http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5 Vendor Advisory
- http://www.exploit-db.com/exploits/31834 Exploit
- http://www.securityfocus.com/archive/1/531176/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/65709 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91253 exchange.xforce.ibmcloud.com
- https://www.htbridge.com/advisory/HTB23201 Exploit
- http://secunia.com/advisories/57079 Vendor Advisory
- http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5 Vendor Advisory
- http://www.exploit-db.com/exploits/31834 Exploit
- http://www.securityfocus.com/archive/1/531176/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/65709 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91253 exchange.xforce.ibmcloud.com
- https://www.htbridge.com/advisory/HTB23201 Exploit