What is CVE-2014-10017?

CVE-2014-10017 is a vulnerability in Welcart E-Commerce, classified under SQL Injection. Published 2015-01-13.

Is CVE-2014-10017 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Welcart E-Commerce

CVE-2014-10017

Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) changeSort or (2) switch parameter in the usces_itemedit page to wp-admin/admin.php.

Vulnerability class: SQL Injection

EPSS: 0.023 (81.8th percentile) — read the EPSS interpretation.

Affected products

Welcart E-commerce — versions 1.3.12
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

References

cve@mitre.org (vdb-entry, x_refsource_BID)
cve@mitre.org (Exploit, x_refsource_MISC)
cve@mitre.org (vdb-entry, x_refsource_XF)

Frequently asked questions

What is CVE-2014-10017?: CVE-2014-10017 is a vulnerability in Welcart E-Commerce, classified under SQL Injection. Published 2015-01-13.
Is CVE-2014-10017 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.