CVE-2015-4066: SQL Injection
Published May 27, 2015
·Updated
Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) showartistid or (2) showvenueid parameter in an add action in the gigpress.php page to wp-admin/admin.php.
Affected Software
1 affected component
Tri GigPress WordPress<=2.3.8
Remediation
Patch Available
Event History
May 27, 2015
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-4066?
CVE-2015-4066 has a high severity rating due to its potential for remote authenticated SQL injection attacks.
2
How do I fix CVE-2015-4066?
To fix CVE-2015-4066, update the GigPress plugin to version 2.3.9 or later.
3
What are the affected versions of GigPress in CVE-2015-4066?
CVE-2015-4066 affects GigPress plugin versions up to and including 2.3.8.
4
Who can exploit CVE-2015-4066?
CVE-2015-4066 can be exploited by remote authenticated users with access to the admin panel.
5
What parameters are involved in exploiting CVE-2015-4066?
The parameters involved are show_artist_id and show_venue_id in the add action on the gigpress.php page.