PT-2015-4049 · Joomla+1 · Joomla!+1

Larry W. Cashdollar + 1 · Published 2015-06-10 · Updated 2015-06-11 · CVE-2014-8603

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.1 for WordPress XCloner plugin version 3.5.1 for Joomla!

Description The issue allows remote administrators to execute arbitrary code via shell metacharacters in various parameters. This can be achieved through the file name when creating a backup or through vectors related to specific variables, including $ CONFIG[tarpath], $ CONFIG['tarcompress'], $ CONFIG['filename'], $ CONFIG['exfile tar'], $ CONFIG[sqldump], $ CONFIG['mysql host'], $ CONFIG['mysql pass'], $ CONFIG['mysql user'], $database name, or $sqlfile.

Recommendations For XCloner plugin version 3.1.1 for WordPress, update to a version that fixes the issue. For XCloner plugin version 3.5.1 for Joomla!, update to a version that fixes the issue. As a temporary workaround, consider restricting access to the cloner.functions.php file until a patch is available. Avoid using shell metacharacters in the file name when creating a backup and in the variables $ CONFIG[tarpath], $ CONFIG['tarcompress'], $ CONFIG['filename'], $ CONFIG['exfile tar'], $ CONFIG[sqldump], $ CONFIG['mysql host'], $ CONFIG['mysql pass'], $ CONFIG['mysql user'], $database name, or $sqlfile until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-8603

Affected Products

Joomla!

Xcloner

References · 5

• 🔥 https://exploit-db.com/exploits/35212 · Exploit
• 🔥 http://vapid.dhs.org/advisory.php?v=110 · Exploit
• 🔥 http://vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8603 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8603 · Note