PT-2024-10624 · WordPress · Webuidesigning Nebulax Theme

Published 2024-12-23 · Updated 2024-12-24 · CVE-2018-25106

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions webuidesigning NebulaX Theme versions up to 5.0 on WordPress

Description A critical vulnerability has been found in the webuidesigning NebulaX Theme, affecting the function nebula send to hubspot of the file libs/Legacy/Legacy.php. The manipulation leads to SQL injection. The attack may be initiated remotely.

Recommendations For webuidesigning NebulaX Theme versions up to 5.0 on WordPress, apply the patch named 41230a81db0f671c570c2644bc2f80565ca83c5a to fix this issue. As a temporary workaround, consider disabling the nebula send to hubspot function until the patch is applied.

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2018-25106

Affected Products

Webuidesigning Nebulax Theme

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-25106 · Security Note
• https://osv.dev/vulnerability/CVE-2018-25106 · Vendor Advisory
• https://t.me/cvenotify/105338 · Telegram Post
• https://vuldb.com/?ctiid.289163 · Note
• https://github.com/webuidesigning/NebulaX/commit/41230a81db0f671c570c2644bc2f80565ca83c5a · Note
• https://vuldb.com/?id.289163 · Note
• https://t.me/cvedetector/13549 · Telegram Post