« Volver al listado

CVE-2017-1002028

Estado: ModificadaCrítica (9.8)—

Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Angrybyte — Gallery-transformation

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-1002028",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "larry0@me.com",
      "affectedData": [
        {
          "vendor": "Angry Byte",
          "product": "wordpress-gallery-transformation",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-14T13:29:01.327",
  "references": [
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=199",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "https://wordpress.org/plugins/wordpress-gallery-transformation/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "https://wpvulndb.com/vulnerabilities/8888",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=199",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/plugins/wordpress-gallery-transformation/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpvulndb.com/vulnerabilities/8888",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad en el plugin wordpress-gallery-transformation v1.0 de WordPress que consiste en una inyección SQL en ./wordpress-gallery-transformation/gallery.php, debido a que no se sanitiza el parámetro $jpic antes de pasarlo a una consulta SQL."
    }
  ],
  "lastModified": "2026-06-17T00:59:22.040",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:angrybyte:gallery-transformation:1.0:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42C33274-5FF8-4F81-A858-2D3D196D7091"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "larry0@me.com"
}