CVE-2009-4748: SQL Injection
First published: Fri Mar 26 2010(Updated: )
SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Andrew Charlton My Category Order | <=2.8 | |
| Andrew Charlton My Category Order | =2.6.1 | |
| Andrew Charlton My Category Order | =2.6.1a | |
| Andrew Charlton My Category Order | =2.7 | |
| Andrew Charlton My Category Order | =2.7.1 | |
| WordPress | ||
| All of | ||
| Any of | ||
| Andrew Charlton My Category Order | <=2.8 | |
| Andrew Charlton My Category Order | =2.6.1 | |
| Andrew Charlton My Category Order | =2.6.1a | |
| Andrew Charlton My Category Order | =2.7 | |
| Andrew Charlton My Category Order | =2.7.1 | |
| WordPress |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2009-4748?
The severity of CVE-2009-4748 is categorized as a high risk due to its potential for SQL injection attacks.
How do I fix CVE-2009-4748?
To fix CVE-2009-4748, update the My Category Order plugin to version 2.9 or later.
What systems are affected by CVE-2009-4748?
CVE-2009-4748 affects My Category Order plugin versions 2.8 and earlier for WordPress.
Can CVE-2009-4748 allow remote attacks?
Yes, CVE-2009-4748 allows remote attackers to execute arbitrary SQL commands.
What is the exploit path for CVE-2009-4748?
The exploit path for CVE-2009-4748 involves manipulating the parentID parameter in the act_OrderCategories action.
- collector/nvd-historical
- agent/references
- agent/type
- agent/weakness
- agent/author
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/source
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/event
- vendor/andrew charlton
- canonical/andrew charlton my category order
- version/andrew charlton my category order/2.8
- version/andrew charlton my category order/2.6.1
- version/andrew charlton my category order/2.6.1a
- version/andrew charlton my category order/2.7
- version/andrew charlton my category order/2.7.1
- vendor/wordpress
- canonical/wordpress