EZ SQL Reports Shortcode Widget and DB Backup, 01aaecbc-6aae-4a33-ac00-1b14b34f4c71

CVE, Research URL: 01aaecbc-6aae-4a33-ac00-1b14b34f4c71
Home page URL: Security reports for EZ SQL Reports Shortcode Widget and DB Backup
Application: EZ SQL Reports Shortcode Widget and DB Backup
Published on: -
Research Description: EZ SQL Reports Shortcode Widget and DB Backup [elisqlreports] < 4.11.37 EZ SQL Reports <= 4.11.33 - Authenticated Arbitrary Code Execution There are several calls to "passtthru" in the code, one of them is receiving the username, password, database name and host from the $_POST arguments, so you can inject in every of this parameter the ";" character or others like "&&" or "||" to execute other distinct commands to "/usr/bin/mysql".
Affected versions: Min -, max 4.11.37.
Status: vulnerable