PT-2014-8937 · WordPress · Bird Feeder

Manideep K · Published 2014-12-24 · Updated 2017-09-08 · CVE-2014-9334

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bird Feeder plugin version 1.2.3

Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks. This is achieved via the user or password parameter in the "bird-feeder" page to "wp-admin/options-general.php" API endpoint.

Recommendations For Bird Feeder plugin version 1.2.3, consider disabling access to the "bird-feeder" page until a patch is available to prevent exploitation via the user or password parameters. Restrict access to the wp-admin/options-general.php endpoint to minimize the risk of cross-site scripting (XSS) attacks.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-9334

Affected Products

Bird Feeder

References · 6

• 🔥 http://packetstormsecurity.com/files/129623/WordPress-Bird-Feeder-1.2.3-CSRF-XSS.html · Exploit
• 🔥 http://vulnerability-lab.com/get_content.php?id=1372 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Dec/69 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9334 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99474 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9334 · Note