CVE-2017-1002028 - Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query

Back Back to CVE browser

CRITICAL

Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query

Published Sep 14, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 2.02%

Description

Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query.

Affected products

Vendor Angry Byte Product Wordpress-Gallery-Transformation Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <1.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Angry Byte

Wordpress-Gallery-Transformation

n/a

Version	Status	Constraints
unspecified	affected	<1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

http://www.vapidlabs.com/advisory.php?v=199
x_refsource_MISCExploitPatchThird Party Advisory
https://wordpress.org/plugins/wordpress-gallery-transformation/
x_refsource_MISCThird Party Advisory
https://wpvulndb.com/vulnerabilities/8888
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
http://www.vapidlabs.com/advisory.php?v=199		x_refsource_MISCExploitPatchThird Party Advisory
https://wordpress.org/plugins/wordpress-gallery-transformation/		x_refsource_MISCThird Party Advisory
https://wpvulndb.com/vulnerabilities/8888		x_refsource_MISCThird Party Advisory