CVE-2014-5368

Nuclei

WordPress Plugin WP Content Source Control - 'download.php' Directory Traversal

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2014-5368 has a selected CVSS score of 5.0; EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin WP Content Source Control - 'download.php' Directory TraversalExploitDB exploitby Henri SaloNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Plugin WP Content Source Control - Directory TraversalCVSS 5

A directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter.

Impact

An attacker can read sensitive files on the server, potentially leading to unauthorized access or exposure of sensitive information.

Remediation

Update to the latest version of the WP Content Source Control plugin to fix the directory traversal vulnerability.

WeaknessesCWE-22
Authorsdaffainfo
Template tagscve2014cvewordpresswp-pluginlfiedbseclistswp_content_source_control_projectvuln
CVSS vector: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
CPE: cpe:2.3:a:wp_content_source_control_project:wp_content_source_control:*:*:*:*:*:wordpress:*:*
Google: inurl:"/wp-content/plugins/wp-source-control"
https://nvd.nist.gov/vuln/detail/CVE-2014-5368 https://www.exploit-db.com/exploits/39287 http://seclists.org/oss-sec/2014/q3/417 https://exchange.xforce.ibmcloud.com/vulnerabilities/95374 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

5