PT-2007-2694 · WordPress · Wordpress

Publicado 2007-03-05 · Atualizado 2018-10-16 · CVE-2007-1277

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress version 2.1.1

Description The issue allows remote attackers to execute arbitrary commands. This is achieved through an eval injection vulnerability in the ix parameter to "wp-includes/feed.php" and an untrusted passthru call in the iz parameter to "wp-includes/theme.php".

Recommendations For WordPress version 2.1.1, consider removing or restricting access to the affected files "wp-includes/feed.php" and "wp-includes/theme.php" to minimize the risk of exploitation. Avoid using the ix and iz parameters in the respective API endpoints until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-1277

Produtos afetados

Wordpress

Referências · 14

• 🔥 http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.html · Exploit
• 🔥 https://exploit-db.com/exploits/29701 · Exploit
• 🔥 https://exploit-db.com/exploits/29702 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32807 · Nota
• http://secunia.com/advisories/24374 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/214480 · Nota
• http://securityfocus.com/bid/22797 · Nota
• http://vupen.com/english/advisories/2007/0812 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32804 · Nota
• http://securityfocus.com/archive/1/461794/100/0/threaded · Nota
• http://kb.cert.org/vuls/id/641456 · Nota
• http://wordpress.org/development/2007/03/upgrade-212 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-1277 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1277 · Nota