CVE-2014-4942

Nuclei

WordPress EasyCart <2.0.6 - Information Disclosure

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2014-4942 has a selected CVSS score of 5.0; EIP currently links 1 Nuclei template.

Description

The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress EasyCart <2.0.6 - Information DisclosureCVSS 5

WordPress EasyCart plugin before 2.0.6 contains an information disclosure vulnerability. An attacker can obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.

Impact

An attacker can gain sensitive information from the target system.

Remediation

Upgrade to WordPress EasyCart version 2.0.6 or later.

WeaknessesCWE-200
AuthorsDhiyaneshDk
Template tagscve2014cvewpscanwordpresswp-pluginwpphpinfodisclosurelevelfourdevelopmentvuln
CVSS vector: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
CPE: cpe:2.3:a:levelfourdevelopment:wp-easycart:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/64ea4135-eb26-4dea-a13f-f4c1deb77150 https://codevigilant.com/disclosure/wp-plugin-wp-easycart-information-disclosure https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4942 https://nvd.nist.gov/vuln/detail/CVE-2014-4942 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=829290%40wp-easycart&old=827627%40wp-easycart&sfp_email=&sfph_mail=

Source: ProjectDiscovery

References

3