CVE-2009-4748

{"id": "CVE-2009-4748", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "[email protected]", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-03-26T20:30:00.610", "references": [{"url": "http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt", "source": "[email protected]"}, {"url": "http://www.exploit-db.com/exploits/9150", "source": "[email protected]"}, {"url": "http://www.securityfocus.com/bid/35704", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51727", "source": "[email protected]"}, {"url": "http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.exploit-db.com/exploits/9150", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/35704", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51727", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en mycategoryorder.php en el plugin My Category Order v2.8 y anteriores para WordPress, permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro parentID en una acci\u00f3n act_OrderCategories sobre wp-admin/post-new.php."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:andrew_charlton:my_category_order:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB42535F-5375-4A9E-81A4-1D6B9DAC509D", "versionEndIncluding": "2.8"}, {"criteria": "cpe:2.3:a:andrew_charlton:my_category_order:2.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC8A48F4-863F-453F-B51C-5F840B71C40A"}, {"criteria": "cpe:2.3:a:andrew_charlton:my_category_order:2.6.1a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AAE77258-9C35-4F15-85C0-19076BA1E28B"}, {"criteria": "cpe:2.3:a:andrew_charlton:my_category_order:2.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9987BA6E-36D6-45AA-9ABB-11272D21726E"}, {"criteria": "cpe:2.3:a:andrew_charlton:my_category_order:2.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF39C70A-7DE1-48EB-94D8-199D55CDCBC3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "847DA578-4655-477E-8A6F-99FBE738E4F9"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}