CVE-2017-1002004
HighSummary
Vulnerability in WordPress plugin DTracker v1.5 is due to the lack of user input sanitization in the ./dtracker/download.php file. The id variable is appended to the SQL query without proper processing.
Risk Assessment
The lack of input sanitization may lead to SQL Injection attacks, jeopardizing the integrity of the database and the security of the application. Organizations may be exposed to unauthorized data access.
Recommendation
It is recommended to update the DTracker plugin to the latest version that includes security fixes. Additionally, implementing input sanitization mechanisms in the application is advisable.
Other vulnerabilities in WordPress plugin DTracker v1.5
See all- CVE-2017-1002007High
Vulnerability in WordPress plugin DTracker v1.5 allows injecting new contacts into the wp_contact table without checking user authorization.
- CVE-2017-1002006High
Vulnerability in WordPress plugin DTracker version 1.5 allows adding new contacts to the wp_contact table without checking user authorization.
- CVE-2017-1002005High
Vulnerability in WordPress plugin DTracker v1.5 is due to lack of input sanitization in the ./dtracker/delete.php file. The contact_id variable is not properly filtered before being appended to an SQL query.
Original NVD description (English source)
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query.