This host is installed with WordPress Google Document Embedder and is prone to sql injection vulnerability.

Successful exploitation will allow attacker to manipulate SQL queries in the backend database, and disclose certain sensitive information. Impact Level: Application

Upgrade to version 2.5.15 or later, For updates refer http://wordpress.org/extend/plugins/google-document-embedder

Flaw is due to the /google-document-embedder /view.php script not properly sanitizing user-supplied input via the 'gpid' GET parameter.

WordPress Google Doc Embedder Plugin version 2.5.14, prior may also be affected.

Send a crafted request via HTTP GET and check whether it is able to execute sql query or not.

• http://1337day.com/exploit/22921
• http://osvdb.org/115044
• http://www.exploit-db.com/exploits/35371
• http://xforce.iss.net/xforce/xfdb/98944
• https://wpvulndb.com/vulnerabilities/7690

---

Updated on 2015-03-25