PT-2014-2766 · Hms · Hms Testimonials

Adéla Goldová · Published 2014-04-02 · Updated 2020-02-03 · CVE-2013-4240

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HMS Testimonials plugin versions prior to 2.0.11

Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including adding new testimonials via the "hms-testimonials-addnew" page, adding new groups via the "hms-testimonials-addnewgroup" page, changing default settings via the "hms-testimonials-settings" page, changing advanced settings via the "hms-testimonials-settings-advanced" page, changing custom fields settings via the "hms-testimonials-settings-fields" page, or changing template settings via the "hms-testimonials-templates-new" page to wp-admin/admin.php.

Recommendations Update to version 2.0.11 or later to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2013-4240

Affected Products

Hms Testimonials

References · 9

• 🔥 https://exploit-db.com/exploits/27531 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4240 · Security Note
• http://seclists.org/oss-sec/2013/q3/345 · Note
• http://seclists.org/fulldisclosure/2013/Aug/98 · Note
• http://seclists.org/fulldisclosure/2013/Aug/96 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4240 · Note
• http://wordpress.org/plugins/hms-testimonials/changelog · Note
• http://seclists.org/oss-sec/2013/q3/361 · Note
• http://osvdb.org/96107 · Note