PT-2015-7561 · WordPress · Cool Video Gallery

Larry W. Cashdollar + 1 · Published 2015-12-17 · Updated 2018-10-09 · CVE-2015-7527

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cool Video Gallery plugin version 1.9

Description The issue allows remote attackers to execute arbitrary code via shell metacharacters in the Width of preview image and possibly other input fields in the "Video Gallery Settings" page. This is due to a vulnerability in the lib/core.php file of the Cool Video Gallery plugin.

Recommendations For Cool Video Gallery plugin version 1.9, consider disabling the plugin until a patch is available to prevent exploitation. Restrict access to the "Video Gallery Settings" page to minimize the risk of arbitrary code execution. Avoid using shell metacharacters in input fields, such as Width of preview image, until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-7527

Affected Products

Cool Video Gallery

References · 8

• 🔥 http://vapidlabs.com/advisory.php?v=158 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2015/12/02/9 · Exploit
• 🔥 http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html · Exploit
• 🔥 https://wordpress.org/support/topic/command-injection-vulnerability-in-v19 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7527 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7527 · Note
• http://securityfocus.com/archive/1/537051/100/0/threaded · Note
• https://wpvulndb.com/vulnerabilities/8348 · Note