WP Symposium Plugin for WordPress forum_functions.php 'topic_id' Parameter SQLi

high Nessus Plugin ID 85629

Language:

Synopsis

The remote web server hosts a web application that is affected by a SQL injection vulnerability.

Description

The WordPress WP Symposium Plugin installed on the remote host is affected by a SQL injection vulnerability due to a failure to properly sanitize user-supplied input to the 'topic_id' parameter of the forum_functions.php script. An unauthenticated, remote attacker can exploit this issue to conduct a blind SQL injection attack against the affected application, resulting in the manipulation or disclosure of arbitrary data.

Solution

Upgrade to WordPress WP Symposium Plugin version 15.8 or later.

Plugin Details

Severity: High

ID: 85629

File Name: wordpress_wp_symposium_topic_id_sqli.nasl

Version: 1.7

Type: remote

Family: CGI abuses

Published: 8/25/2015

Updated: 6/5/2024

Supported Sensors: Nessus

Enable CGI Scanning: true

Vulnerability Information

CPE: cpe:/a:wpsymposium:wp_symposium, cpe:/a:wordpress:wordpress

Required KB Items: installed_sw/WordPress, www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Patch Publication Date: 8/7/2015

Vulnerability Publication Date: 8/10/2015

Detections

Analytics