Description
Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
References
- [oss-security] 20150720 Re: Remote file upload vulnerability & SQLi in wordpress plugin wp-powerplaygallery v3.3 mailing-list
- http://www.vapid.dhs.org/advisory.php?v=132
- 20150713 Remote file upload vulnerability & SQLi in wordpress plugin wp-powerplaygallery v3.3 mailing-list
- http://packetstormsecurity.com/files/132671/WordPress-WP-PowerPlayGallery-3.3-File-Upload-SQL-Injection.html