PT-2019-13711 · Unknown · Social Photo Gallery

Publicado 2019-11-18 · Atualizado 2020-08-24 · CVE-2019-14467

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Social Photo Gallery plugin version 1.0

Description The issue allows remote code execution by creating an album and attaching a malicious PHP file in the cover photo album. This is possible because the file extension is not checked, enabling an attacker to execute arbitrary code.

Recommendations For Social Photo Gallery plugin version 1.0, consider disabling the album creation feature until a patch is available to prevent remote code execution. Restrict access to uploading files, especially PHP files, to minimize the risk of exploitation.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-14467

Produtos afetados

Social Photo Gallery

Referências · 6

• 🔥 https://seclists.org/fulldisclosure/2019/Nov/13 · Exploit
• 🔥 http://packetstormsecurity.com/files/155357/WordPress-Social-Photo-Gallery-1.0-Remote-Code-Execution.html · Exploit
• https://wpvulndb.com/vulnerabilities/9952 · Nota
• https://wordpress.org/plugins/social-photo-gallery/#developers · Nota
• https://osv.dev/vulnerability/CVE-2019-14467 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14467 · Nota de Segurança