« Volver al listado

CVE-2014-3961

Estado: ModificadaAlta (7.5)—

SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Xnau — Participants Database

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3961",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-06-04T14:55:07.047",
  "references": [
    {
      "url": "http://osvdb.org/show/osvdb/107626",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/Jun/0",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/33613",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/67769",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wordpress.org/plugins/participants-database/changelog",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.yarubo.com/advisories/1",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/show/osvdb/107626",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.com/files/126878/WordPress-Participants-Database-1.5.4.8-SQL-Injection.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/Jun/0",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/33613",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/67769",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/plugins/participants-database/changelog",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.yarubo.com/advisories/1",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an \"output CSV\" action to pdb-signup/."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección SQL en la página Export CSV en el plugin Participants Database anterior a 1.5.4.9 para WordPress permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro query en una acción 'output CSV' hacia pdb-signup/."
    }
  ],
  "lastModified": "2026-06-17T00:09:12.590",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xnau:participants_database:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04358834-C853-44DC-B289-92640FFF705D",
              "versionEndIncluding": "1.5.4.8"
            },
            {
              "criteria": "cpe:2.3:a:xnau:participants_database:1.5.4:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93D00F6B-85E5-48B9-AC9F-192D29237FD4"
            },
            {
              "criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.1:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1806461-1884-4DE8-8F7F-662A53DA0C28"
            },
            {
              "criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.2:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1AF9B82A-4C29-4D1A-816E-15914155D16A"
            },
            {
              "criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.3:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19154509-7445-4DB5-ABAD-8BCB1273C180"
            },
            {
              "criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.4:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F98BAC02-69D8-4921-B076-18BCD59AC907"
            },
            {
              "criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.5:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA5D4784-FC07-47B1-8FD9-03AEB684206A"
            },
            {
              "criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.6:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F87C256-9049-41CF-8C5C-B3EE961CD972"
            },
            {
              "criteria": "cpe:2.3:a:xnau:participants_database:1.5.4.7:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2782A534-D28D-4F60-A044-B09CB1FD1DB6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}