7.5

CVE-2009-2143

FireStats < 1.6.2 - Remote File Inclusion

PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the fs_javascript parameter.
Mögliche Gegenmaßnahme
firestats: Update to version 1.6.2, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Firestats ≫ Firestats Update stable Version <= 1.6.1
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 0.9.0-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 0.9.1-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 0.9.2-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 0.9.3-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 0.9.4-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 0.9.5-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 0.9.6-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 0.9.7-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 0.9.8-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 0.9.9
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.0
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.0.0 Update rc1
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.0.1 Update rc2
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.0.2 Update rc3
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.0.2 Update stable
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.1.1 Update rc1
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.1.2 Update rc2
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.1.3 Update rc3
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.1.3 Update rc4
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.1.4 Update rc5
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.1.5 Update stable
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.1.6 Update stable
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.1.7 Update stable
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.1.8 Update stable
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.2.0-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.2.1 Update rc1
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.2.2 Update rc2
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.2.3 Update rc3
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.2.4 Update stable
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.3.0-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.3.1-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.3.2-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.3.3-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.3.4 Update rc1
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.3.5 Update rc2
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.3.6 Update stabe
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.4
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.4.0-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.4.1-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.4.2-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.4.3 Update rc1
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.4.4 Update stable
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.0-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.1-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.2-beta
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.3 Update rc1
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.4 Update rc2
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.5 Update rc3
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.7 Update rc1
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.8 Update rc2
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.9 Update rc3
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.10 Update rc4
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.11 Update stable
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.5.12 Update stable
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.6
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.6.0
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.6.0 Update rc1
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.6.0 Update rc2
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.6.0 Update rc3
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.6.0 Update rc4
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.6.0 Update stable
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.6.0-beta1
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.6.0-beta2
   Wordpress ≫ Wordpress
Firestats ≫ Firestats Version 1.6.1
   Wordpress ≫ Wordpress
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt firestats
Version [*, 1.6.2)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.82% 0.847
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://firestats.cc/wiki/ChangeLog#a1.6.2-stable13062009
Patch
Vendor Advisory
http://secunia.com/advisories/35400
Vendor Advisory
https://www.exploit-db.com/exploits/8945
https://www.wordfence.com/threat-intel/vulnerabilities/id/05544f69-bc9b-4270-80c9-96afe4793cb6
Third Party Advisory