PT-2014-2391 · WordPress · Forumpress Wp Forum Server

Lucidcrew · Published 2014-01-16 · Updated 2016-12-08 · CVE-2012-6622

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ForumPress WP Forum Server plugin versions prior to 1.7.4

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the groupid parameter in an "editgroup" action or the usergroup id parameter in an "edit usergroup" action.

Recommendations For versions prior to 1.7.4, update to version 1.7.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the fs-admin/fs-admin.php file to minimize the risk of exploitation. Avoid using the groupid and usergroup id parameters in the affected actions until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-6622

Affected Products

Forumpress Wp Forum Server

References · 8

• 🔥 http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/37195 · Exploit
• http://wordpress.org/extend/plugins/forum-server/changelog · Vendor Advisory
• http://secunia.com/advisories/49155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6622 · Security Note
• http://securityfocus.com/bid/53530 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6622 · Note
• https://plugins.trac.wordpress.org/changeset/532918 · Note