PT-2019-7760 · WordPress · Real3D-Flipbook-Lite

Mukarram Khalid · Publicado 2019-09-16 · Atualizado 2019-09-17 · CVE-2016-10967

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions real3d-flipbook-lite plugin version 1.0

Description The issue concerns a problem with the real3d-flipbook-lite plugin for WordPress, where there is a potential for XSS via the bookId parameter in the /wp-content/plugins/real3d-flipbook/includes/flipbooks.php endpoint.

Recommendations For real3d-flipbook-lite plugin version 1.0, avoid using the bookId parameter in the affected endpoint until the issue is resolved. Consider temporarily restricting access to the flipbooks.php file to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-10967

Produtos afetados

Real3D-Flipbook-Lite

Referências · 4

• 🔥 https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit · Exploit
• https://osv.dev/vulnerability/CVE-2016-10967 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10967 · Nota de Segurança
• https://wordpress.org/plugins/real3d-flipbook-lite/#developers · Nota