7.2

CVE-2022-0537

Exploit

MapPress Maps for WordPress <= 2.73.12 - Admin+ File Upload to Remote Code Execution

The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.
Mögliche Gegenmaßnahme
MapPress Maps for WordPress: Update to version 2.73.13, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt MapPress Maps for WordPress
Version [*, 2.73.13)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mappresspro ≫ Mappress SwPlatformwordpress Version < 2.73.13
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.88% 0.745
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.