PT-2008-5980 · WordPress · Wordpress

Mark Jaquith · Publicado 2008-10-28 · Atualizado 2017-08-08 · CVE-2008-4769

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 2.3.3 WordPress version 2.5

Description A directory traversal issue exists in the get category template function, allowing remote attackers to include and possibly execute arbitrary PHP files. This is achieved by manipulating the cat parameter in the "index.php" endpoint.

Recommendations For WordPress versions prior to 2.3.3, update to a version later than 2.3.3 to resolve the issue. For WordPress version 2.5, consider disabling the get category template function or restricting access to the cat parameter in the "index.php" endpoint until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-4769

DSA-1871-1

DSA-1871-2

Produtos afetados

Wordpress

Referências · 12

• 🔥 https://exploit-db.com/exploits/31670 · Exploit
• 🔥 http://securityfocus.com/bid/28845 · Exploit
• http://trac.wordpress.org/changeset/7586 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4769 · Nota de Segurança
• http://juniper.fi/security/auto/vulnerabilities/vuln28845.html · Nota
• http://debian.org/security/2009/dsa-1871 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4769 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4769 · Nota
• https://osv.dev/vulnerability/CVE-2008-4769 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41920 · Nota
• http://secunia.com/advisories/29949 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2008-4769 · Aviso do Fabricante