CVE-2014-6242: SQL Injection
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-6242?
CVE-2014-6242 is classified as a high severity vulnerability due to its potential to allow arbitrary SQL command execution.
How do I fix CVE-2014-6242?
To fix CVE-2014-6242, update the All In One WP Security & Firewall plugin to version 3.8.3 or later.
Who is affected by CVE-2014-6242?
CVE-2014-6242 affects users of the All In One WP Security & Firewall plugin prior to version 3.8.3 on WordPress.
What types of SQL injection are present in CVE-2014-6242?
CVE-2014-6242 includes multiple SQL injection vulnerabilities that can be exploited through the orderby and order parameters.
Can CVE-2014-6242 be exploited by unauthenticated users?
No, CVE-2014-6242 requires that an attacker be an authenticated user to exploit the vulnerabilities.