medium4.0Public exploit code
CVE-2014-8606
Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla!
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin / Joomla! Component XCloner - Multiple Vulnerabilities2014-11-10 · webapps · php
Impact
Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xcloner | Xcloner | Versions 3.1.1, 3.5.1 |