PT-2015-7561 · WordPress · Cool Video Gallery

Larry W. Cashdollar + 1 · Publicado 2015-12-17 · Atualizado 2018-10-09 · CVE-2015-7527

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cool Video Gallery plugin version 1.9

Description The issue allows remote attackers to execute arbitrary code via shell metacharacters in the Width of preview image and possibly other input fields in the "Video Gallery Settings" page. This is due to a vulnerability in the lib/core.php file of the Cool Video Gallery plugin.

Recommendations For Cool Video Gallery plugin version 1.9, consider disabling the plugin until a patch is available to prevent exploitation. Restrict access to the "Video Gallery Settings" page to minimize the risk of arbitrary code execution. Avoid using shell metacharacters in input fields, such as Width of preview image, until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2015-7527

Produtos afetados

Cool Video Gallery

Referências · 8

• 🔥 http://vapidlabs.com/advisory.php?v=158 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2015/12/02/9 · Exploit
• 🔥 http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html · Exploit
• 🔥 https://wordpress.org/support/topic/command-injection-vulnerability-in-v19 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7527 · Nota
• http://securityfocus.com/archive/1/537051/100/0/threaded · Nota
• https://wpvulndb.com/vulnerabilities/8348 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7527 · Nota de Segurança