What the vulnerability does
01Description
A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the function hd_add_media/hd_update_media of the file functions.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 34d66b9f3231a0e2dc0e536a6fe615d736e863f7. It is recommended to upgrade the affected component. VDB-225350 is the identifier assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The HD FLV Player Plugin contains a SQL injection vulnerability in its database query handling. An attacker with low-level user access can inject malicious SQL commands to read, modify, or delete database records. The vulnerability requires authentication but no user interaction, making it exploitable by any logged-in user with sufficient privileges.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete database records by injecting SQL commands through the plugin.
Potential impact on your site
04Site Impact
Unauthorized database access could expose user data, corrupt site content, or compromise site functionality.
Conditions required to exploit
05Prerequisites
Attacker must have low-level user account access to the site.
Key dates
06Disclosure timeline
April 9, 2023
CVE published
August 6, 2024
Record updated
