A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument order_by/order with the input ASC%2c(select*from(select(sleep(2)))a) leads to sql injection (Blind). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.9 is able to address this issue. It is recommended to upgrade the affected component.
References
Link | Resource |
---|---|
http://seclists.org/fulldisclosure/2017/Feb/67 | Exploit Mailing List Third Party Advisory |
https://vuldb.com/?id.97335 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: VulDB
Published: 2022-06-27T21:50:11
Updated: 2022-06-27T21:50:11
Reserved: 2022-06-25T00:00:00
Link: CVE-2017-20103
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-06-27T22:15:08.647
Modified: 2022-07-07T18:36:17.430
Link: CVE-2017-20103
JSON object: View
Redhat Information
No data.
CWE