CVE-2015-1375

Summary

pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://seclists.org/fulldisclosure/2015/Jan/75
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php
• http://www.osvdb.org/117146
• http://www.exploit-db.com/exploits/35846
• http://www.securityfocus.com/archive/1/534505/100/0/threaded
• http://www.openwall.com/lists/oss-security/2015/01/25/5
• http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html

References

• http://seclists.org/fulldisclosure/2015/Jan/75
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php
• http://www.osvdb.org/117146
• http://www.exploit-db.com/exploits/35846
• http://www.securityfocus.com/archive/1/534505/100/0/threaded
• http://www.openwall.com/lists/oss-security/2015/01/25/5
• http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html

• ←Previous
• Next→