CVE-2014-4577

Nuclei

WP AmASIN – The Amazon Affiliate Shop - Local File Inclusion

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2014-4577 has a selected CVSS score of 5.0; EIP currently links 1 Nuclei template.

Description

Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWP AmASIN – The Amazon Affiliate Shop - Local File InclusionCVSS 5

Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter.

Impact

Attackers can read arbitrary files including configuration files, database credentials, and sensitive system files, potentially leading to complete site compromise.

Remediation

Update to version 0.9.7 or later, or remove the plugin if no longer maintained.

WeaknessesCWE-22
AuthorsDhiyaneshDK
Template tagscvecve2014wordpresswpscanwp-pluginlfiwpwp-amasin-the-amazon-affiliate-shopvuln
CVSS vector: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
CPE: cpe:2.3:a:websupporter:wp_amasin_-_the_amazon_affiliate_shop:*:*:*:*:*:wordpress:*:*
https://codevigilant.com/disclosure/wp-plugin-wp-amasin-the-amazon-affiliate-shop-local-file-inclusion/ https://wpscan.com/plugin/wp-amasin-the-amazon-affiliate-shop/ https://github.com/superlink996/chunqiuyunjingbachang

Source: ProjectDiscovery

References

3