CVE-2017-6097
HighSummary
The Mail Masta plugin (also known as mail-masta) version 1.0 for WordPress has a SQL injection issue. This issue affects the /inc/campaign/count_of_send.php file and requires authentication to the WordPress admin panel, using the POST parameter: camp_id.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to the database, potentially resulting in the disclosure of sensitive information or data modification.
Recommendation
It is recommended to update the Mail Masta plugin to the latest version to mitigate this vulnerability. Additionally, monitoring access logs to the WordPress admin panel is advisable to detect potential attack attempts.
Other vulnerabilities in Mail Masta plugin 1.0 for WordPress
See all- CVE-2017-6578High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue affects the ./inc/subscriber_list.php file and the POST parameter: subscriber_email.
- CVE-2017-6577High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue affects the ./inc/subscriber_list.php file and the POST Parameter: list_id.
- CVE-2017-6576High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue affects the file ./inc/campaign/campaign-delete.php and the GET parameter: id.
- CVE-2017-6575High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/lists/edit_member.php file with the GET Parameter: member_id.
- CVE-2017-6574High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue exists in the ./inc/lists/edit_member.php file with the GET Parameter: filter_list.
- CVE-2017-6573High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/lists/edit-list.php file with the GET Parameter: id.
- CVE-2017-6572High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/lists/add_member.php file with the GET Parameter: filter_list.
- CVE-2017-6571High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/campaign/view-campaign.php file with the GET Parameter: id.
- CVE-2017-6570High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/campaign/view-campaign-list.php file with the GET Parameter: id.
- CVE-2017-6095Critical
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability in the /inc/lists/csvexport.php file. This issue affects unauthenticated access using the GET parameter: list_id.
Original NVD description (English source)
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.php (Requires authentication to Wordpress admin) with the POST Parameter: camp_id.