Description

SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the serendipity[plugin_to_conf] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).

Remediation

References

CVE-2012-2332

Related Vulnerabilities

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-14619)

WordPress Plugin Absolute Reviews Cross-Site Request Forgery (1.0.8)

WordPress Plugin Automated Content for Real Estate Multiple Unspecified Vulnerabilities (5.4.2)

WordPress Plugin User Access Manager Cross-Site Scripting (1.2.14)

Omeka Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-3980)

Severity

High

Classification

CVE-2012-2332 CWE-138

Tags

Missing Update Known Vulnerabilities