PT-2019-7385 · WordPress · Manual-Image-Crop

Marcin Probola · Publicado 2019-09-26 · Atualizado 2019-09-26 · CVE-2015-9426

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions manual-image-crop plugin before version 1.11 for WordPress

Description The issue concerns a CSRF with resultant XSS in the manual-image-crop plugin for WordPress. This occurs via the "wp-admin/admin-ajax.php?action=mic editor window" API endpoint, specifically through the postId parameter.

Recommendations For versions prior to 1.11, update to version 1.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin-ajax.php?action=mic editor window" API endpoint to minimize the risk of exploitation. Avoid using the postId parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-9426

Produtos afetados

Manual-Image-Crop

Referências · 6

• 🔥 https://wpvulndb.com/vulnerabilities/8297 · Exploit
• 🔥 http://cinu.pl/research/wp-plugins/mail_7c87194ce1dcf0642135d17a71ed91cd.html · Exploit
• https://wordpress.org/plugins/manual-image-crop/#developers · Nota
• https://t.me/cibsecurity/7019 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9426 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-9426 · Nota de Segurança