PT-2014-7115 · WordPress · All-In-One-Wp-Security-And-Firewall

Published 2014-10-02 · Updated 2018-10-09 · CVE-2014-6242

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions All In One WP Security & Firewall plugin versions prior to 3.8.3

Description The issue allows remote authenticated users to execute arbitrary SQL commands via the orderby or order parameter in the aiowpsec page to wp-admin/admin.php. This can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.

Recommendations For versions prior to 3.8.3, update to version 3.8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the aiowpsec page in wp-admin/admin.php to minimize the risk of exploitation. Avoid using the orderby and order parameters in the affected page until the issue is resolved.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-6242

Affected Products

All-In-One-Wp-Security-And-Firewall

References · 10

• 🔥 https://exploit-db.com/exploits/34781 · Exploit
• 🔥 http://packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.html · Exploit
• 🔥 http://exploit-db.com/exploits/34781 · Exploit
• 🔥 https://htbridge.com/advisory/HTB23231 · Exploit
• 🔥 http://securityfocus.com/bid/70150 · Exploit
• https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6242 · Security Note
• http://securityfocus.com/archive/1/533519/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96204 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6242 · Note