PT-2014-8477 · WordPress · Wp-Dbmanager

Larry W. Cashdollar · Published 2014-10-31 · Updated 2018-10-09 · CVE-2014-8334

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WP-DBManager plugin versions prior to 2.7.2

Description The issue allows remote authenticated users to execute arbitrary commands. This can be achieved by injecting shell metacharacters into the filepath or mysqldumppath variables.

Recommendations For WP-DBManager plugin versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2014-8334

Affected Products

Wp-Dbmanager

References · 12

• 🔥 http://seclists.org/oss-sec/2014/q4/410 · Exploit
• 🔥 http://vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.html · Exploit
• 🔥 http://packetstormsecurity.com/files/128785/WordPress-Database-Manager-2.7.1-Command-Injection-Credential-Leak.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Oct/99 · Exploit
• 🔥 http://seclists.org/oss-sec/2014/q4/365 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8334 · Security Note
• https://wordpress.org/plugins/wp-dbmanager/changelog · Patch
• http://securityfocus.com/bid/70626 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8334 · Note
• http://osvdb.org/show/osvdb/113508 · Note
• http://securityfocus.com/archive/1/533763/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97689 · Note