cve/cves/2015/CVE-2015-6522.md

CVE-2015-6522

Description

SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.

POC

Reference

• https://www.exploit-db.com/exploits/37824/

Github

• https://github.com/Michael-Meade/snackhack2

ExploitDB

• https://www.exploit-db.com/exploits/37824

Metasploit

• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/wp_symposium_sql_injection.rb