PT-2014-7844 · Akeeba · Cms Update+5

Johannes Dahse · Publicado 2014-11-03 · Atualizado 2016-05-09 · CVE-2014-7228

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Akeeba Restore versions 2.5.4 through 2.5.25 Akeeba Restore versions 3.x through 3.2.5 Akeeba Restore versions 3.3.0 through 3.3.4 Akeeba Backup for Joomla! Professional versions 3.0.0 through 4.0.2 Backup Professional for WordPress versions 1.0.b1 through 1.1.3 Solo versions 1.0.b1 through 1.1.2 Admin Tools Core and Professional versions 2.0.0 through 2.4.4 CMS Update versions 1.0.a1 through 1.0.1

Description The issue allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive. This occurs when the software is performing a backup or update for an archive and does not properly delete parameters from $ GET and $ POST when cleansing $ REQUEST. Later, it accesses $ GET and $ POST using the getQueryParam function, enabling the exploitation.

Recommendations For Akeeba Restore versions 2.5.4 through 2.5.25, update to a version that properly cleanses $ REQUEST. For Akeeba Restore versions 3.x through 3.2.5, update to a version that properly cleanses $ REQUEST. For Akeeba Restore versions 3.3.0 through 3.3.4, update to a version that properly cleanses $ REQUEST. For Akeeba Backup for Joomla! Professional versions 3.0.0 through 4.0.2, update to a version that properly cleanses $ REQUEST. For Backup Professional for WordPress versions 1.0.b1 through 1.1.3, update to a version that properly cleanses $ REQUEST. For Solo versions 1.0.b1 through 1.1.2, update to a version that properly cleanses $ REQUEST. For Admin Tools Core and Professional versions 2.0.0 through 2.4.4, update to a version that properly cleanses $ REQUEST. For CMS Update versions 1.0.a1 through 1.0.1, update to a version that properly cleanses $ REQUEST.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2014-7228

Produtos afetados

Admin Tools

Akeeba Backup For Joomla!

Akeeba Restore

Backup Professional For Wordpress

Cms Update

Solo

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/joomla_akeeba_unserialize.rb · Exploit
• 🔥 http://websec.wordpress.com/2014/10/05/joomla-3-3-4-akeeba-kickstart-remote-code-execution-cve-2014-7228 · Exploit
• 🔥 https://exploit-db.com/exploits/35033 · Exploit
• https://akeebabackup.com/home/news/1605-security-update-sep-2014.html · Aviso do Fabricante
• http://developer.joomla.org/security/595-20140903-core-remote-file-inclusion.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-7228 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7228 · Nota