Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
100Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 83%
de la publicación al arma0 días
Publicada en NVD6 sept
1ª PoC5 sept
VulnCheck+89d
probabilidad de explotación
83%top 1% de las CVE
explotación observada
síVulnCheck
5 exploit(s) público(s)
The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
dglingren · Media Library AssistantPoCs públicas encontradas — 5
exploitdbwww.exploit-db.com/exploits/51737no verificadogithubgithub.com/Patrowl/CVE-2023-4634★ 47githubgithub.com/Evillm/CVE-2023-4634-PoC★ 0cve_referencepacketstormsecurity.com/files/174508/wpmla309-lfiexec.tgzno verificadovulncheckvulncheck.com/xdb/7d09ad797bb8no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://github.com/Patrowl/CVE-2023-4634/https://packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgzhttps://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2955933%40media-library-assistant&new=2955933%40media-library-assistant&sfp_email=&sfph_mail=#file4https://www.wordfence.com/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf?source=cve