CVE-2014-9305 in Cart66 Lite
Summary
SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a shortcode_products_table action to wp-admin/admin-ajax.php.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Reservation
12/07/2014
Disclosure
12/08/2014
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 73151 | Reality66 Cart66 Lite shortcodeProductsTable sql injection | 89 | High | Official fix | CVE-2014-9305 |