« Volver al listado

CVE-2017-1002005

Estado: ModificadaAlta (7.5)—

Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dtracker Project — Dtracker

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-1002005",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "larry0@me.com",
      "affectedData": [
        {
          "vendor": "ITFlux",
          "product": "DTracker",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.5",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-14T13:29:00.390",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/96781",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=183",
      "tags": [
        "Exploit"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "https://wordpress.org/plugins/dtracker/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/96781",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=183",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/plugins/dtracker/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad en el plugin DTracker v1.5 de WordPress. En el archivo ./dtracker/delete.php no se sanitizan los valores de entrada del usuario por medio de la variable contact_id antes de añadirla al final de una consulta SQL."
    }
  ],
  "lastModified": "2026-06-17T00:59:19.710",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dtracker_project:dtracker:1.5:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EB87112-8F47-4EEC-8C98-0BFE853CB65B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "larry0@me.com"
}