CVE-2015-9465 SQL injection in n/a

What is CVE-2015-9465?

CVE-2015-9465 is a high-severity SQL injection vulnerability in n/a, published on 10 Oct 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.

Weakness: CWE-89

Which versions are affected by CVE-2015-9465?

It affects 1 product.

Products include Yet Another Stars Rating Project Yet Another Stars Rating.

How do I fix CVE-2015-9465?

No fix has been published for CVE-2015-9465 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2015-9465 being exploited?

There is no known exploitation of CVE-2015-9465 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-23980 WordPress Yasr – Yet Another Stars Rating plugin <= 2.9.9 - Cross-Site Scripting (XSS) vulnerability Medium 4.7
• CVE-2023-37867 WordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race Condition Low 3.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q33w-jqv2-jw5m.