CERT-In Vulnerability Note
CIVN-2014-0273
Multiple Vulnerabilities in Various Plugins of Wordpress
Original Issue Date:December 08, 2014
Severity Rating: MEDIUM
Systems Affected
- DukaPress plugin prior to 2.5.4
- BulletProof Security plugin prior to .51.1
Overview
Multiple vulnerabilities have been reported in various plugins of Wordpress which could allow a remote attacker to read arbitrary files, conduct cross site scripting attacks, SQL injection attacks or Server Side Request Forgery attacks.
Description
1. Path Disclosure Vulnerability in DukaPress Plugin
(
CVE-2014-8799
)
This vulnerability exists in the dp_img_resize() function in php/dp-functions.php in the DukaPress plugin due to an input validation error. A remote attacker could exploit this vulnerability by sending a specially crafted URL containing the sequene ".." (dot dot) in the src parameter to lib/dp_image.php. Successful exploitation of this vulnerability could allow the attacker to read arbitrary files.
2. Cross Site Scripting Vulnerability in BulletProof Security Plugin
(
CVE-2014-7958
)
This vulnerability exists in the admin/htaccess/bpsunlock.php in the BulletProof Security plugin due to improper sanitization of user-supplied input. A remote attacker could exploit this vulnerability by sending specially crafted requests via a dbhost parameter to inject arbitrary web scripts or HTML to steal the victims cookie-based authentication credentials.
3. SQL Injection Vulnerability in BulletProof Security Plugin
(
CVE-2014-7959
)
This vulnerability exists in the admin/htaccess/bpsunlock.php in the BulletProof Security plugin due to improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability by sending specially crafted requests via the tableprefix parameter to execute arbitrary SQL commands.
4. Server-Side Request Forgery Vulnerability in BulletProof Security Plugin
(
CVE-2014-8749
)
This vulnerability exists in the admin/htaccess/bpsunlock.php in the BulletProof Security plugin due to improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability by sending malicious HTTP requests via the dbhost parameter to trigger outbound requests. Successful exploitation of this vulnerability could lead to access to arbitrary databases.
Solution
Apply appropriate patches as mentioned in the following links
https://wordpress.org/plugins/dukapress/changelog/
https://wordpress.org/plugins/bulletproof-security/changelog/
Vendor Information
WordPress
https://www.wordpress.org/
References
XForce
http://xforce.iss.net/xforce/xfdb/98506
http://xforce.iss.net/xforce/xfdb/98507
http://xforce.iss.net/xforce/xfdb/98943
http://xforce.iss.net/xforce/xfdb/98505
Security Focus
http://www.securityfocus.com/bid/71294/
http://www.securityfocus.com/bid/70916/
http://www.securityfocus.com/bid/70918/
http://www.securityfocus.com/bid/70924/
CVE Name
CVE-2014-7958
CVE-2014-8799
CVE-2014-7959
CVE-2014-8749
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|