What is CVE-2009-4748?

CVE-2009-4748 is a vulnerability in Andrew Charlton My Category Order, classified under SQL Injection. Published 2010-03-26.

Is CVE-2009-4748 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Andrew Charlton My Category Order

CVE-2009-4748

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.

Vulnerability class: SQL Injection

EPSS: 0.027 (84.7th percentile) — read the EPSS interpretation.

Affected products

Andrew_charlton My_category_order — versions 2.6.1, 2.7.1, 2.6.1a
Wordpress
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

20142995/nuclei-templates

References

cve@mitre.org (x_refsource_MISC)
cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
cve@mitre.org (vdb-entry, x_refsource_XF)

Frequently asked questions

What is CVE-2009-4748?: CVE-2009-4748 is a vulnerability in Andrew Charlton My Category Order, classified under SQL Injection. Published 2010-03-26.
Is CVE-2009-4748 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.