CVE-2019-14230

CRITICO 9.8CVE-2019-14230 · Published 21/07/2019 · updated 17/06/2026

In breve

CVE-2019-14230 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda onionbuzz (onionbuzz).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 4.6%, superiore al 91.7% delle vulnerabilità.
Correzione: aggiornare a 1.2.7 o successiva.

Package	Affected versions	Patched versions
onionbuzz onionbuzz	`< 1.2.7`	`1.2.7`

Description

An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set_count ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.

References

openwall.com/lists/oss-security/2019/07/23/1 · Exploit
openwall.com/lists/oss-security/2019/07/21/1 · Exploit

Altre vulnerabilità di onionbuzz

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free