CVE-2017-12199 SQL injection in n/a
SQL injection in Etoile Ultimate Product Catalog plugin allows attackers to read or modify database contents via admin-ajax.php actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12199?
CVE-2017-12199 is a critical SQL injection vulnerability in n/a, published on 2 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-item, video_update_order video-item, image_update_order list-item, tag_group_update_order list_item, category_products_update_order category-product-item, custom_fields_update_order field-item, categories_update_order category-item, subcategories_update_order subcategory-item, and tags_update_order tag-list-item.
Weakness: CWE-89
Which versions are affected by CVE-2017-12199?
It affects 1 product.
Products include Etoilewebdesign Ultimate Product Catalog.
How do I fix CVE-2017-12199?
No fix has been published for CVE-2017-12199 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2017-12199 being exploited?
There is no known exploitation of CVE-2017-12199 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-g597-wwq3-w36v.