Vulnerability CVE-2008-5695 - CERT Civis.Net

Vulnerability Name:

CVE-2008-5695 (CCN-40266)

Assigned:

2008-02-05

Published:

2008-02-05

Updated:

2021-04-21

Summary:

wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins.

CVSS v3 Severity:

4.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

8.5 High (CVSS v2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C)
6.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.0 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P)
4.7 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: Wordpress MU Web site
WordPress MU

Source: MITRE
Type: CNA
CVE-2008-5695

Source: CONFIRM
Type: Release Notes, Vendor Advisory
http://mu.wordpress.org/forums/topic.php?id=7534&page&replies=1

Source: CCN
Type: SA28789
WordPress MU File Upload and Security Bypass

Source: SECUNIA
Type: Third Party Advisory
28789

Source: SREASON
Type: Third Party Advisory
4798

Source: CCN
Type: WordPress Web site
WordPress Blog Tool and Weblog Platform

Source: CCN
Type: Buayacorp Web site
WordPress [MU] blog's options overwrite

Source: MISC
Type: Exploit, Third Party Advisory
http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.html

Source: MISC
Type: Exploit, Third Party Advisory
http://www.buayacorp.com/files/wordpress/wp-blog-option-overwrite.txt

Source: CCN
Type: OSVDB ID: 41134
WordPress MU wp-admin/options.php Arbitrary PHP Code Upload / Execution

Source: BID
Type: Third Party Advisory, VDB Entry
27633

Source: CCN
Type: BID-27633
WordPress 'wp-admin/options.php' Remote Code Execution Vulnerability

Source: XF
Type: UNKNOWN
wordpress-options-file-upload(40266)

Source: EXPLOIT-DB
Type: Exploit, Third Party Advisory, VDB Entry
5066

Vulnerable Configuration:

Configuration 1:

cpe:/a:wordpress:wordpress:*:*:*:*:*:*:*:* (Version <= 2.3.2)

OR cpe:/a:wordpress:wordpress_mu:*:*:*:*:*:*:*:* (Version < 1.3.2)

Configuration CCN 1:

cpe:/a:wordpress:wordpress:0.7:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.2:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.2.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5.1.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5.1.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:*:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.3:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.5:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.6:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.1.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.1.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.1.3:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.2:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.2.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress_mu:1.0:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.3:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.9:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.11:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.3.2:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.3.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.2.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.10:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.7:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.1.3:rc2:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.1.3:rc1:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.6.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.6.2.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.71:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.0:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.0.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.2.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.3.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5-strayhorn:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5.1.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.10:rc1:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.10:rc2:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.8:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.711:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.4:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.6:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress_mu:1.3.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress_mu:1.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress_mu:1.2.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress_mu:1.2.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.71::gold:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.0.2::blakey:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.0::platinum:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.2:delta:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.2::mingus:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.2:beta:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.72:rc1:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.72:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.1:alpha_3:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.72:beta1:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.72:beta2:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.3.1:rc1:*:*:*:*:*:*

Denotes that component is vulnerable