CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 7.5
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: multiple sql injection vulnerabilities in the wp-forum plugin before 2.4 for wordpress allow remote attackers to execute arbitrary sql commands via (1) the search_max parameter in a search action to the default uri, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default uri, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default uri, related to wpf-post.php.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2009-12-18
Last Modified Date: 2018-10-10