SQL injection vulnerability in counter-options.php in the Count Per Day...
Vulnerability Description
SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the cpd_keep_month parameter to wp-admin/options-general.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-5533
Credits & Attribution
No credits recorded in the NVD database.
References
- https://www.htbridge.com/advisory/HTB23267
- http://packetstormsecurity.com/files/132811/WordPress-Count-Per-Day-3.4-SQL-Injection.html
- https://plugins.trac.wordpress.org/changeset/1190683/count-per-day
- https://www.exploit-db.com/exploits/37707/
- https://wpvulndb.com/vulnerabilities/8110
- http://www.securityfocus.com/archive/1/536056/100/0/threaded
More from count per day project
View All →Affected Vendor
count per day project
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.