PT-2008-1850 · WordPress · Math Comment Spam Protection

Mustlive · Publicado 2008-01-10 · Atualizado 2018-10-15 · CVE-2008-0205

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Math Comment Spam Protection plugin for WordPress version 2.1 and earlier

Description The issue affects the math-comment-spam-protection.php file in the Math Comment Spam Protection plugin for WordPress, allowing remote attackers to perform actions as administrators. This is achieved via the mcsp opt msg no answer or mcsp opt msg wrong answer parameter to the "wp-admin/options-general.php" endpoint.

Recommendations For Math Comment Spam Protection plugin for WordPress version 2.1 and earlier, consider disabling the plugin until a patch is available to prevent exploitation of the CSRF vulnerabilities. Restrict access to the "wp-admin/options-general.php" endpoint to minimize the risk of exploitation. Avoid using the mcsp opt msg no answer and mcsp opt msg wrong answer parameters in the affected endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-0205

Produtos afetados

Math Comment Spam Protection

Referências · 5

• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0205 · Nota de Segurança
• http://securityreason.com/securityalert/3539 · Nota
• http://securityfocus.com/archive/1/485786/100/0/threaded · Nota
• http://websecurity.com.ua/1576 · Nota