CVE-2015-5308

Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user, (2) isadmin, (3) mail service, (4) mailresceipt, (5) stellv, (6) champtipp, (7) tippgroup, or (8) userid parameter.

Score

CVSS 2.0 7.5 High

Status

Modified - secalert@redhat.com

Published

2015-11-02

Last modified

2024-08-06

Weaknesses

CWE-89

Affected products

• Wp-championship (Wp-championship Project)

References

• http://www.vapid.dhs.org/advisory.php?v=155
• https://wpvulndb.com/vulnerabilities/8221