>> WP-Forum Plugin for WordPress "user" SQL Query Injection Vulnerability
Title : WP-Forum Plugin for WordPress "user" SQL Query Injection Vulnerability VUPEN ID : VUPEN/ADV-2008-0235 CVE ID : CVE-2008-0388
Rated as : Moderate Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2008-01-22
Technical Description
A vulnerability has been identified in WP-Forum (plugin for WordPress), which could be exploited by malicious users to conduct SQL injection attacks. This issue is caused by an input validation error in the "forum_get_profile()" [forum-functions.php] function when processing the "user" parameter, which could be exploited by attackers to inject arbitrary SQL queries.
Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback If you have additional information or corrections for this security advisory please submit them via our contact form.
