PT-2012-3014 · Likno · Allwebmenus

Published 2012-02-07 · Updated 2017-08-29 · CVE-2012-1011

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AllWebMenus plugin version 1.1.8

Description The issue allows remote attackers to bypass access restrictions, upload, and execute arbitrary PHP code. This is achieved by setting the HTTP REFERER to a specific value, uploading a ZIP file that contains a PHP file, and then accessing the uploaded file directly.

Recommendations For AllWebMenus plugin version 1.1.8, consider disabling the actions.php file until a patch is available to prevent the upload and execution of arbitrary PHP code. Restrict access to the upload functionality to minimize the risk of exploitation. Avoid using the HTTP REFERER variable in security checks as it can be easily manipulated by attackers.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1011

Affected Products

Allwebmenus

References · 9

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html · Exploit
• 🔥 https://exploit-db.com/exploits/18407 · Exploit
• 🔥 http://exploit-db.com/exploits/18407 · Exploit
• http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog · Patch
• http://secunia.com/advisories/47659 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1011 · Security Note
• http://securityfocus.com/bid/51615 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1011 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72640 · Note