CVE-2011-5216 SQL injection in n/a
Remote attackers can execute arbitrary SQL commands via the active parameter in the SCORM Cloud WordPress plugin, potentially compromising database integrity.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-5216?
CVE-2011-5216 is a high-severity SQL injection vulnerability in Wordpress Wordpress, published on 25 Oct 2012. It can be exploited over the network, with no action from the victim.
Official description
SQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the active parameter. NOTE: some of these details are obtained from third party information.
Weakness: CWE-89
Which versions are affected by CVE-2011-5216?
It affects 2 products.
Products include Troyef Scorm Cloud, Wordpress Wordpress.
How do I fix CVE-2011-5216?
Upgrade to a fixed version.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2011-5216 being exploited?
There is no known exploitation of CVE-2011-5216 in the wild and no public exploit code.
Sources
Also known as GHSA-2cv7-399j-p9vv, MINI-7v4m-88gh-25qh, MINI-9597-x7r8-846f.