SB2018062209 - SQL injection in iThemes Security for WordPress

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018062209

SB2018062209 - SQL injection in iThemes Security for WordPress

Published: June 22, 2018 Updated: July 29, 2021

Security Bulletin ID SB2018062209
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) SQL injection (CVE-ID: CVE-2018-12636)

The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.

The vulnerability exists due to insufficient sanitization of user-supplied data in "orderby" parameter on the "itsec-logs" page. A remote authenticated administrator can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in web application database.

Successful exploitation of the vulnerability may allow an attacker to gain administrative access to vulnerable web application.


Remediation

Install update from vendor's website.

References