Exploitation Summary
EIP tracks 3 public exploits for CVE-2014-1610.
PoCs published by Metasploit, @u0x, Netanel Rubin, Brandon Perry, Ben Harris, Ben Campbell, including Metasploit module exploits/multi/http/mediawiki_thumb.
AI-analyzed exploit summary This Metasploit module exploits CVE-2014-1610, a remote command execution vulnerability in MediaWiki's thumb.php when DjVu or PDF file upload support is enabled. It leverages shell metacharacters to execute arbitrary commands, with support for automatic target detection and authentication if required.
Description
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
Exploits (3)
This Metasploit module exploits CVE-2014-1610, a remote command execution vulnerability in MediaWiki's thumb.php when DjVu or PDF file upload support is enabled. It leverages shell metacharacters to execute arbitrary commands, with support for automatic target detection and authentication if required.
This exploit leverages a command injection vulnerability in MediaWiki's PdfHandler extension (CVE-2014-1610) by manipulating the 'w' parameter in thumb.php to execute arbitrary shell commands, leading to remote code execution.
This Metasploit module exploits a command injection vulnerability in MediaWiki's Thumb.php when DjVu or PDF file upload support is enabled. It allows remote unauthenticated users to execute arbitrary commands via shell metacharacters.