freshmail-newsletter Plugin up to 1.5 on WordPress shortcode.php Shortcode sql injection

A vulnerability, which was classified as critical, was found in freshmail-newsletter Plugin up to 1.5 on WordPress (WordPress Plugin). This affects an unknown part of the file shortcode.php. The manipulation with the input value FM_form id= leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. This is going to have an impact on confidentiality, integrity, and availability. An attacker might be able inject and/or alter existing SQL statements which would influence the database exchange.

The weakness was released 10/22/2019 as EDB-ID 36942 as uncorroborated exploit (Exploit-DB). The advisory is shared at exploit-db.com. This vulnerability is uniquely identified as CVE-2015-9496 since 10/14/2019. It is possible to initiate the attack remotely. Technical details and a public exploit are known.

After immediately, there has been an exploit disclosed. It is declared as proof-of-concept. The exploit is shared for download at exploit-db.com.

Upgrading to version 1.6 eliminates this vulnerability.

Type

• WordPress Plugin

Name

• freshmail-newsletter Plugin

• 🔒
• 🔒
• 🔒

• 🔒
• 🔒
• 🔒

VulDB Meta Base Score: 6.3
VulDB Meta Temp Score: 5.8

VulDB Base Score: 6.3
VulDB Temp Score: 5.8
VulDB Vector: 🔒
VulDB Reliability: 🔍

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Sql injection (CWE-89)
Local: No
Remote: Yes

Availability: 🔒
Access: Public
Status: Proof-of-Concept
Download: 🔒

Price Prediction: 🔍
Current Price Estimation: 🔒

Exploit-DB: 🔒

Threat Intelligenceinfoedit

Threat: 🔍
Adversaries: 🔍
Geopolitics: 🔍
Economy: 🔍
Predictions: 🔍
Remediation: 🔍Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒
Exploit Delay Time: 🔍

Upgrade: freshmail-newsletter Plugin 1.6

10/14/2019 CVE assigned
10/22/2019 +8 days Advisory disclosed
10/22/2019 +0 days Exploit disclosed
10/22/2019 +0 days EDB entry disclosed
10/23/2019 +1 days VulDB entry created
10/23/2019 +0 days VulDB last updateAdvisory: EDB-ID 36942
Status: Uncorroborated

CVE: CVE-2015-9496 (🔒)

Created: 10/23/2019 08:25 AM
Complete: 🔍

Comments

Comments are closed.