PT-2023-32374 · WordPress · Ads By Datafeedr.Com

István Márton + 1 · CVE-2023-5843 · Publicado 2023-10-30 · Atualizado 2023-11-13

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ads by datafeedr.com plugin for WordPress versions up to, and including, 1.1.3

Description The issue allows unauthenticated attackers to execute code on the server via the dfads ajax load ads function. This function has limited parameters that cannot be specified arbitrarily, allowing for remote code execution.

Recommendations For versions up to, and including, 1.1.3, consider disabling the dfads ajax load ads function as a temporary workaround until a patch is available.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-5843

Produtos afetados

Ads By Datafeedr.Com

Referências · 7

• 🔥 https://plugins.trac.wordpress.org/browser/ads-by-datafeedrcom/tags/1.1.3/inc/dfads.class.php#L34 · Exploit
• https://plugins.trac.wordpress.org/changeset/2991088/ads-by-datafeedrcom · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-5843 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1719034196042162646 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-5843 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1718994955731955815 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/5412fd87-49bc-445c-8d16-443e38933d1e?source=cve · Nota