CVE-2014-9520

High

Published: 05/01/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

SQL injection vulnerability in the InfiniteWP Admin Panel before version 2.4.4 in execute.php allows remote attackers to execute arbitrary SQL commands via the historyID parameter.

Risk Assessment

Attackers can exploit this vulnerability to manipulate database data, potentially leading to data integrity loss and unauthorized access to information.

Recommendation

It is recommended to update the InfiniteWP Admin Panel to version 2.4.4 or later to mitigate this vulnerability.

Other vulnerabilities in InfiniteWP Admin Panel

See all

CVE-2014-9521High
An unrestricted file upload vulnerability exists in the InfiniteWP Admin Panel before version 2.4.4 in uploadScript.php. This allows remote attackers to execute arbitrary code by uploading a file with a double extension.
CVE-2014-9519High
An SQL injection vulnerability in the InfiniteWP Admin Panel before version 2.4.3 in login.php allows remote attackers to execute arbitrary SQL commands via the email parameter.

Original NVD description (English source)

SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter.