what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Leo LE BOUTER

WordPress Plainview Activity Monitor 20161228 Remote Command Execution

Posted Nov 29, 2019

Authored by Leo LE BOUTER | Site metasploit.com

WordPress Plainview Activity Monitor plugin is vulnerable to OS command injection which allows an attacker to remotely execute commands on the underlying system. Application passes unsafe user supplied data to ip parameter into activities_overview.php. Privileges are required in order to exploit this vulnerability. Vulnerable plugin version: 20161228 and possibly prior. Fixed plugin version: 20180826.

tags | exploit, php

advisories | CVE-2018-15877

SHA-256 | 7ec3e2886cfeb10934e1758d21c4a3b07426bc1755426426441b88d92cfd7024

Download | Favorite | View