{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an \"output CSV\" action to pdb-signup/."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-10-03T16:20:25", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.yarubo.com/advisories/1"}, {"name": "33613", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/33613"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://wordpress.org/plugins/participants-database/changelog"}, {"name": "20140601 Yarubo #1: Arbitrary SQL Execution in Participants Database\tfor Wordpress", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2014/Jun/0"}, {"name": "107626", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/show/osvdb/107626"}, {"name": "67769", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/67769"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-3961", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an \"output CSV\" action to pdb-signup/."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.html"}, {"name": "https://www.yarubo.com/advisories/1", "refsource": "MISC", "url": "https://www.yarubo.com/advisories/1"}, {"name": "33613", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/33613"}, {"name": "https://wordpress.org/plugins/participants-database/changelog", "refsource": "CONFIRM", "url": "https://wordpress.org/plugins/participants-database/changelog"}, {"name": "20140601 Yarubo #1: Arbitrary SQL Execution in Participants Database\tfor Wordpress", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2014/Jun/0"}, {"name": "107626", "refsource": "OSVDB", "url": "http://osvdb.org/show/osvdb/107626"}, {"name": "67769", "refsource": "BID", "url": "http://www.securityfocus.com/bid/67769"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-3961", "datePublished": "2022-10-03T16:20:25", "dateReserved": "2022-10-03T00:00:00", "dateUpdated": "2022-10-03T16:20:25", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xnau:participants_database:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "04358834-C853-44DC-B289-92640FFF705D", "versionEndIncluding": "1.5.4.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:xnau:participants_database:1.5.4:*:*:*:*:wordpress:*:*", "matchCriteriaId": "93D00F6B-85E5-48B9-AC9F-192D29237FD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.1:*:*:*:*:wordpress:*:*", "matchCriteriaId": "C1806461-1884-4DE8-8F7F-662A53DA0C28", "vulnerable": true}, {"criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.2:*:*:*:*:wordpress:*:*", "matchCriteriaId": "1AF9B82A-4C29-4D1A-816E-15914155D16A", "vulnerable": true}, {"criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.3:*:*:*:*:wordpress:*:*", "matchCriteriaId": "19154509-7445-4DB5-ABAD-8BCB1273C180", "vulnerable": true}, {"criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.4:*:*:*:*:wordpress:*:*", "matchCriteriaId": "F98BAC02-69D8-4921-B076-18BCD59AC907", "vulnerable": true}, {"criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.5:*:*:*:*:wordpress:*:*", "matchCriteriaId": "DA5D4784-FC07-47B1-8FD9-03AEB684206A", "vulnerable": true}, {"criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.6:*:*:*:*:wordpress:*:*", "matchCriteriaId": "9F87C256-9049-41CF-8C5C-B3EE961CD972", "vulnerable": true}, {"criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.7:*:*:*:*:wordpress:*:*", "matchCriteriaId": "2782A534-D28D-4F60-A044-B09CB1FD1DB6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an \"output CSV\" action to pdb-signup/."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en la p\u00e1gina Export CSV en el plugin Participants Database anterior a 1.5.4.9 para WordPress permite a atacantes remotos ejecutar comandos SQL arbitrarios a trav\u00e9s del par\u00e1metro query en una acci\u00f3n 'output CSV' hacia pdb-signup/."}], "id": "CVE-2014-3961", "lastModified": "2024-02-14T01:17:43.863", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-06-04T14:55:07.047", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/show/osvdb/107626"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.html"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://seclists.org/fulldisclosure/2014/Jun/0"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/33613"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/67769"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://wordpress.org/plugins/participants-database/changelog"}, {"source": "cve@mitre.org", "tags": ["Exploit", "URL Repurposed"], "url": "https://www.yarubo.com/advisories/1"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}