PT-2008-1850 · WordPress · Math Comment Spam Protection

Mustlive · Published 2008-01-10 · Updated 2018-10-15 · CVE-2008-0205

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Math Comment Spam Protection plugin for WordPress version 2.1 and earlier

Description The issue affects the math-comment-spam-protection.php file in the Math Comment Spam Protection plugin for WordPress, allowing remote attackers to perform actions as administrators. This is achieved via the mcsp opt msg no answer or mcsp opt msg wrong answer parameter to the "wp-admin/options-general.php" endpoint.

Recommendations For Math Comment Spam Protection plugin for WordPress version 2.1 and earlier, consider disabling the plugin until a patch is available to prevent exploitation of the CSRF vulnerabilities. Restrict access to the "wp-admin/options-general.php" endpoint to minimize the risk of exploitation. Avoid using the mcsp opt msg no answer and mcsp opt msg wrong answer parameters in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0205

Affected Products

Math Comment Spam Protection

References · 5

• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0205 · Security Note
• http://securityreason.com/securityalert/3539 · Note
• http://securityfocus.com/archive/1/485786/100/0/threaded · Note
• http://websecurity.com.ua/1576 · Note