.. / CVE-2015-4062

Exploit for WordPress NewStatPress 0.9.8 - SQL Injection (CVE-2015-4062)

Description:

WordPress NewStatPress 0.9.8 plugin contains a SQL injection vulnerability in includes/nsp_search.php. A remote authenticated user can execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php.

Nuclei Template

View the template here CVE-2015-4062.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2015/CVE-2015-4062.yaml
Copy

References:

https://wordpress.org/plugins/newstatpress/changelog/
http://packetstormsecurity.com/files/132038/WordPress-NewStatPress-0.9.8-Cross-Site-Scripting-SQL-Injection.html
https://packetstormsecurity.com/files/132038/
https://nvd.nist.gov/vuln/detail/CVE-2015-4062
https://wordpress.org/plugins/newstatpress