PT-2018-14476 · Arigato · Arigato Autoresponder/Newsletter

Publicado 2018-10-18 · Atualizado 2018-11-30 · CVE-2018-18461

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arigato Autoresponder and Newsletter plugin version 2.5.1.7

Description The issue allows remote attackers to execute arbitrary code by injecting PHP code into the attachments[] data sent to the models/attachment.php file. This enables attackers to perform unauthorized actions on the system.

Recommendations For version 2.5.1.7, consider disabling the models/attachment.php file or restricting access to it until a patch is available to prevent exploitation.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2018-18461

Produtos afetados

Arigato Autoresponder/Newsletter

Referências · 4

• 🔥 https://github.com/rakjong/vuln/blob/master/woedpress-Arigato%20Autoresponder_and_Newsletter-getshell.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2018-18461 · Aviso do Fabricante
• https://wordpress.org/plugins/bft-autoresponder/#developers · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-18461 · Nota de Segurança