CVE-2007-1277

28Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendepss 27%

de la publicación al arma0 días

Publicada en NVD5 mar

1ª PoC2 mar

probabilidad de explotación

27%top 2% de las CVE

explotación observada

noninguna fuente lo reporta

2 exploit(s) público(s)

WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/29702 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/29701

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.html http://secunia.com/advisories/24374 https://exchange.xforce.ibmcloud.com/vulnerabilities/32804 https://exchange.xforce.ibmcloud.com/vulnerabilities/32807 http://wordpress.org/development/2007/03/upgrade-212/http://www.kb.cert.org/vuls/id/214480 http://www.kb.cert.org/vuls/id/641456 http://www.securityfocus.com/archive/1/461794/100/0/threaded http://www.securityfocus.com/bid/22797 http://www.vupen.com/english/advisories/2007/0812