PT-2008-6747 · WordPress · Wordpress+1

Alexander Concha · Publicado 2008-12-19 · Atualizado 2021-04-21 · CVE-2008-5695

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WordPress MU versions prior to 1.3.2 WordPress versions prior to 2.3.3

Description The issue allows remote authenticated users with manage options and upload files capabilities to execute arbitrary code. This is achieved by uploading a PHP script and adding the script's pathname to active plugins.

Recommendations For WordPress MU versions prior to 1.3.2, update to version 1.3.2 or later. For WordPress versions prior to 2.3.3, update to version 2.3.3 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-5695

Produtos afetados

Wordpress

Wordpress Mu

Referências · 12

• 🔥 http://buayacorp.com/files/wordpress/wp-blog-option-overwrite.txt · Exploit
• 🔥 https://exploit-db.com/exploits/5066 · Exploit
• 🔥 http://buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.html · Exploit
• https://security-tracker.debian.org/tracker/CVE-2008-5695 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-5695 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2008-5695 · Aviso do Fabricante
• http://securityreason.com/securityalert/4798 · Nota
• http://secunia.com/advisories/28789 · Nota
• http://securityfocus.com/bid/27633 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-5695 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5695 · Nota
• http://mu.wordpress.org/forums/topic.php?id=7534&page&replies=1 · Aviso do Fabricante