PT-2018-11300 · Ithemes · Ithemes Security

Çlirim Emini · Published 2018-06-22 · Updated 2020-12-16 · CVE-2018-12636

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iThemes Security (better-wp-security) plugin version 7.0.3 and earlier

Description The issue allows SQL Injection via the logs page, specifically targeting attackers with Admin privileges.

Recommendations For versions prior to 7.0.3, update to version 7.0.3 or later to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-12636

Affected Products

Ithemes Security

References · 6

• 🔥 https://exploit-db.com/exploits/44943 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-12636 · Security Note
• https://osv.dev/vulnerability/CVE-2018-12636 · Vendor Advisory
• https://wordpress.org/plugins/better-wp-security/#developers · Note
• https://t.me/cvenotify/7142 · Telegram Post
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E · Note