cve/2015/CVE-2015-2314.md

CVE-2015-2314

Description

SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/feed.

POC

Reference

• http://klikki.fi/adv/wpml.html
• http://packetstormsecurity.com/files/130810/WordPress-WPML-XSS-Deletion-SQL-Injection.html

Github

No PoCs found on GitHub currently.