CVEvulnerability
CVE-2016-0769
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-01-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.
Affected configurations
• elfden eshop plugin 6.3.14
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://www.openwall.com/lists/oss-security/2016/02/02/3 Exploit, Third Party Advisory
- http://www.securityfocus.com/bid/82347 Third Party Advisory, VDB Entry
- http://www.vapid.dhs.org/advisory.php?v=160 Exploit, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/02/02/3 Exploit, Third Party Advisory
- http://www.securityfocus.com/bid/82347 Third Party Advisory, VDB Entry
- http://www.vapid.dhs.org/advisory.php?v=160 Exploit, Third Party Advisory