SP Project & Document Manager, CVE-2014-9178

CVE, Research URL: CVE-2014-9178
Home page URL: Security reports for SP Project & Document Manager
Application: SP Project & Document Manager
Published on: Dec 02, 2014
Research Description: Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter in the email_vendor function or id parameter in the (2) download_project, (3) download_archive, or (4) remove_cat function.
Affected versions: max 2.4.4.
Status: vulnerable

SP Project &amp; Document Manager, CVE-2014-9178