medium5.0Public exploit code
CVE-2015-4616
Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Easy2Map 1.24 - SQL Injection2015-07-08 · webapps · php
Impact
Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary files via a .. (dot dot) in the map_id parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Easy2map Project | Easy2map | through 1.2.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2015/Jul/18
- http://www.securityfocus.com/archive/1/535922/100/0/threaded
- http://www.vapid.dhs.org/advisory.php?v=131
- https://plugins.trac.wordpress.org/changeset/1191455/easy2map
- https://www.exploit-db.com/exploits/37534/
- http://seclists.org/fulldisclosure/2015/Jul/18
- http://www.securityfocus.com/archive/1/535922/100/0/threaded
- http://www.vapid.dhs.org/advisory.php?v=131
- https://plugins.trac.wordpress.org/changeset/1191455/easy2map
- https://www.exploit-db.com/exploits/37534/