Vulnerabilites related to andrew_charlton - my_category_order
CVE-2009-4748 (GCVE-0-2009-4748)
Vulnerability from cvelistv5
Published
2010-03-26 20:00
Modified
2024-08-07 07:17
Severity ?
CWE
  • n/a
Summary
SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.
References
http://www.exploit-db.com/exploits/9150exploit, x_refsource_EXPLOIT-DB
https://exchange.xforce.ibmcloud.com/vulnerabilities/51727vdb-entry, x_refsource_XF
http://www.securityfocus.com/bid/35704vdb-entry, x_refsource_BID
http://packetstormsecurity.org/0907-exploits/wpmco-sql.txtx_refsource_MISC
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:17:24.985Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "9150",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/9150"
          },
          {
            "name": "mycategoryorder-mycategoryorder-sql-inj(51727)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51727"
          },
          {
            "name": "35704",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35704"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-07-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "9150",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/9150"
        },
        {
          "name": "mycategoryorder-mycategoryorder-sql-inj(51727)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51727"
        },
        {
          "name": "35704",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35704"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-4748",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "9150",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/9150"
            },
            {
              "name": "mycategoryorder-mycategoryorder-sql-inj(51727)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51727"
            },
            {
              "name": "35704",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35704"
            },
            {
              "name": "http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-4748",
    "datePublished": "2010-03-26T20:00:00",
    "dateReserved": "2010-03-26T00:00:00",
    "dateUpdated": "2024-08-07T07:17:24.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2010-03-26 20:30
Modified
2025-04-11 00:51
Severity ?
Summary
SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.
References
cve@mitre.orghttp://packetstormsecurity.org/0907-exploits/wpmco-sql.txt
cve@mitre.orghttp://www.exploit-db.com/exploits/9150
cve@mitre.orghttp://www.securityfocus.com/bid/35704Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/51727
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/9150
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/35704Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/51727
Impacted products
Vendor Product Version
andrew_charlton my_category_order *
andrew_charlton my_category_order 2.6.1
andrew_charlton my_category_order 2.6.1a
andrew_charlton my_category_order 2.7
andrew_charlton my_category_order 2.7.1
wordpress wordpress *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:andrew_charlton:my_category_order:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB42535F-5375-4A9E-81A4-1D6B9DAC509D",
              "versionEndIncluding": "2.8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:andrew_charlton:my_category_order:2.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC8A48F4-863F-453F-B51C-5F840B71C40A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:andrew_charlton:my_category_order:2.6.1a:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAE77258-9C35-4F15-85C0-19076BA1E28B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:andrew_charlton:my_category_order:2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "9987BA6E-36D6-45AA-9ABB-11272D21726E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:andrew_charlton:my_category_order:2.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF39C70A-7DE1-48EB-94D8-199D55CDCBC3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "847DA578-4655-477E-8A6F-99FBE738E4F9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyecci\u00f3n SQL en mycategoryorder.php en el plugin My Category Order v2.8 y anteriores para WordPress, permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro parentID en una acci\u00f3n act_OrderCategories sobre wp-admin/post-new.php."
    }
  ],
  "id": "CVE-2009-4748",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-03-26T20:30:00.610",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.exploit-db.com/exploits/9150"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/35704"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51727"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.exploit-db.com/exploits/9150"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/35704"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51727"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}