CVE-2014-4944: SQL Injection

Published Jul 14, 2014

Updated

Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) categoryid or (2) pdfid parameter to wp-admin/admin.php.

Affected Software

1 affected component

BannerSky Bsk Pdf Manager Wordpress=1.3.2

Event History

Jul 14, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4944?

CVE-2014-4944 has a high severity rating due to its potential for unauthorized SQL command execution.

How do I fix CVE-2014-4944?

To fix CVE-2014-4944, update the BSK PDF Manager plugin to the latest version that addresses these vulnerabilities.

Who is affected by CVE-2014-4944?

CVE-2014-4944 affects remote authenticated users of the BSK PDF Manager plugin version 1.3.2 for WordPress.

What are the vulnerable parameters in CVE-2014-4944?

The vulnerable parameters in CVE-2014-4944 are 'categoryid' and 'pdfid' in the wp-admin/admin.php file.

Can CVE-2014-4944 be exploited remotely?

Yes, CVE-2014-4944 can be exploited remotely by authenticated users to execute arbitrary SQL commands.