PT-2014-7844 · Akeeba · Cms Update+5

Johannes Dahse · Published 2014-11-03 · Updated 2016-05-09 · CVE-2014-7228

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Akeeba Restore versions 2.5.4 through 2.5.25 Akeeba Restore versions 3.x through 3.2.5 Akeeba Restore versions 3.3.0 through 3.3.4 Akeeba Backup for Joomla! Professional versions 3.0.0 through 4.0.2 Backup Professional for WordPress versions 1.0.b1 through 1.1.3 Solo versions 1.0.b1 through 1.1.2 Admin Tools Core and Professional versions 2.0.0 through 2.4.4 CMS Update versions 1.0.a1 through 1.0.1

Description The issue allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive. This occurs when the software is performing a backup or update for an archive and does not properly delete parameters from $ GET and $ POST when cleansing $ REQUEST. Later, it accesses $ GET and $ POST using the getQueryParam function, enabling the exploitation.

Recommendations For Akeeba Restore versions 2.5.4 through 2.5.25, update to a version that properly cleanses $ REQUEST. For Akeeba Restore versions 3.x through 3.2.5, update to a version that properly cleanses $ REQUEST. For Akeeba Restore versions 3.3.0 through 3.3.4, update to a version that properly cleanses $ REQUEST. For Akeeba Backup for Joomla! Professional versions 3.0.0 through 4.0.2, update to a version that properly cleanses $ REQUEST. For Backup Professional for WordPress versions 1.0.b1 through 1.1.3, update to a version that properly cleanses $ REQUEST. For Solo versions 1.0.b1 through 1.1.2, update to a version that properly cleanses $ REQUEST. For Admin Tools Core and Professional versions 2.0.0 through 2.4.4, update to a version that properly cleanses $ REQUEST. For CMS Update versions 1.0.a1 through 1.0.1, update to a version that properly cleanses $ REQUEST.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-7228

Affected Products

Admin Tools

Akeeba Backup For Joomla!

Akeeba Restore

Backup Professional For Wordpress

Cms Update

Solo

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/joomla_akeeba_unserialize.rb · Exploit
• 🔥 http://websec.wordpress.com/2014/10/05/joomla-3-3-4-akeeba-kickstart-remote-code-execution-cve-2014-7228 · Exploit
• 🔥 https://exploit-db.com/exploits/35033 · Exploit
• https://akeebabackup.com/home/news/1605-security-update-sep-2014.html · Vendor Advisory
• http://developer.joomla.org/security/595-20140903-core-remote-file-inclusion.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7228 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7228 · Note