9.8

CVE-2015-9272

Exploit

VideoWhisper Video Presentation <= 4.1.4 - Arbitrary File Upload

The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Mögliche Gegenmaßnahme
VideoWhisper Video Presentation: Update to version 4.6.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Videowhisper ≫ Video Presentation Version3.31.17 SwPlatformwordpress
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt VideoWhisper Video Presentation
Version *-4.1.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.99% 0.911
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://www.vapidlabs.com/advisory.php?v=117
Third Party Advisory
Exploit
https://www.openwall.com/lists/oss-security/2015/04/01/2
Third Party Advisory
Exploit
Mailing List
https://www.wordfence.com/threat-intel/vulnerabilities/id/cc26d20e-3ecd-438e-a123-5015ecc17290
Third Party Advisory