← voltar
CVE-2015-3986

CVE-2015-3986

EPSS 3.4%
Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Produtos afetados
n/a · n/a
PoCs públicas encontradas — 3
cve_referencepacketstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.htmlnão verificadocve_referencewww.exploit-db.com/exploits/36860/não verificadoexploitdbwww.exploit-db.com/exploits/36860não verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.htmlhttps://wordpress.org/plugins/thecartpress/changelog/https://www.exploit-db.com/exploits/36860/https://www.htbridge.com/advisory/HTB23254http://www.securityfocus.com/archive/1/535396/100/0/threadedhttp://www.securityfocus.com/bid/74395