PT-2015-4049 · Joomla+1 · Joomla!+1

Larry W. Cashdollar + 1 · Publicado 2015-06-10 · Atualizado 2015-06-11 · CVE-2014-8603

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.1 for WordPress XCloner plugin version 3.5.1 for Joomla!

Description The issue allows remote administrators to execute arbitrary code via shell metacharacters in various parameters. This can be achieved through the file name when creating a backup or through vectors related to specific variables, including $ CONFIG[tarpath], $ CONFIG['tarcompress'], $ CONFIG['filename'], $ CONFIG['exfile tar'], $ CONFIG[sqldump], $ CONFIG['mysql host'], $ CONFIG['mysql pass'], $ CONFIG['mysql user'], $database name, or $sqlfile.

Recommendations For XCloner plugin version 3.1.1 for WordPress, update to a version that fixes the issue. For XCloner plugin version 3.5.1 for Joomla!, update to a version that fixes the issue. As a temporary workaround, consider restricting access to the cloner.functions.php file until a patch is available. Avoid using shell metacharacters in the file name when creating a backup and in the variables $ CONFIG[tarpath], $ CONFIG['tarcompress'], $ CONFIG['filename'], $ CONFIG['exfile tar'], $ CONFIG[sqldump], $ CONFIG['mysql host'], $ CONFIG['mysql pass'], $ CONFIG['mysql user'], $database name, or $sqlfile until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-8603

Produtos afetados

Joomla!

Xcloner

Referências · 5

• 🔥 https://exploit-db.com/exploits/35212 · Exploit
• 🔥 http://vapid.dhs.org/advisory.php?v=110 · Exploit
• 🔥 http://vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8603 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8603 · Nota de Segurança