CVEvulnerability
CVE-2014-3961
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-06-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/.
Affected configurations
• xnau participants database (<= 1.5.4.8)
• xnau participants database 1.5.4
• xnau participants database 1.5.4.1
• xnau participants database 1.5.4.2
• xnau participants database 1.5.4.3
• xnau participants database 1.5.4.4
• xnau participants database 1.5.4.5
• xnau participants database 1.5.4.6
• xnau participants database 1.5.4.7
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://osvdb.org/show/osvdb/107626 osvdb.org
- http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.html Exploit
- http://seclists.org/fulldisclosure/2014/Jun/0 Exploit
- http://www.exploit-db.com/exploits/33613 Exploit
- http://www.securityfocus.com/bid/67769 www.securityfocus.com
- https://wordpress.org/plugins/participants-database/changelog Patch
- https://www.yarubo.com/advisories/1 Exploit, URL Repurposed
- http://osvdb.org/show/osvdb/107626 osvdb.org
- http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.html Exploit
- http://seclists.org/fulldisclosure/2014/Jun/0 Exploit
- http://www.exploit-db.com/exploits/33613 Exploit
- http://www.securityfocus.com/bid/67769 www.securityfocus.com
- https://wordpress.org/plugins/participants-database/changelog Patch
- https://www.yarubo.com/advisories/1 Exploit, URL Repurposed