Vulnerability CVE-2013-6243 - CERT Civis.Net

Vulnerability Name:

CVE-2013-6243 (CCN-87803)

Assigned:

2013-10-10

Published:

2013-10-10

Updated:

2017-08-29

Summary:

SQL injection vulnerability in the Landing Pages plugin 1.2.3, before 20131009, and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the "post" parameter to index.php.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
6.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
6.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Data Manipulation

References:

Source: MITRE
Type: CNA
CVE-2013-6243

Source: OSVDB
Type: UNKNOWN
98334

Source: CONFIRM
Type: Exploit, Patch
http://plugins.trac.wordpress.org/changeset?reponame=&old=785535%40landing-pages&new=785535%40landing-pages

Source: CCN
Type: SA55192
WordPress Landing Pages Plugin "post" SQL Injection Vulnerability

Source: SECUNIA
Type: Vendor Advisory
55192

Source: CONFIRM
Type: UNKNOWN
http://wordpress.org/plugins/landing-pages/changelog

Source: CCN
Type: Landing Pages plugin for WordPress Web site
WordPress WordPress Landing Pages « WordPress Plugins

Source: CCN
Type: WordPress Plugin Directory
WordPress Landing Pages

Source: CCN
Type: OSVDB ID: 98334
Landing Pages Plugin for WordPress index.php post Parameter SQL Injection

Source: BID
Type: UNKNOWN
62942

Source: CCN
Type: BID-62942
WordPress Landing Pages Plugin 'post' Parameter SQL Injection Vulnerability

Source: XF
Type: UNKNOWN
landingpages-index-sql-injection(87803)

Source: XF
Type: UNKNOWN
landingpages-index-sql-injection(87803)

Vulnerable Configuration:

Configuration 1:

cpe:/a:landing_pages_project:landing_pages_plugin:1.0.3.7:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.3.8:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.3.9:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.4.1:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.4.2:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.4.4:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.5.1:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.5.3:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.5.6:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.7.1:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.7.3:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.7.9:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.8.1:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.8.4:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.8.5:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.8.6:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.9.0:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.9.3:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.9.4:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.0.9.9:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.1:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.1.0.1:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.1.7:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.1.8:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.1.9:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:1.2.1:-:*:*:*:wordpress:*:*

OR cpe:/a:landing_pages_project:landing_pages_plugin:*:-:*:*:*:wordpress:*:* (Version <= 1.2.3)

Denotes that component is vulnerable