CVE-2014-8607
XCloner 3.1.1 and 3.5.1 - Exposure of Sensitive Information via Command Line Arguments
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-8607. PoCs published by Larry W. Cashdollar.
AI-analyzed exploit summary The exploit demonstrates arbitrary command execution in XCloner WordPress/Joomla! backup plugin due to unsanitized user input passed to exec() functions. Multiple input fields are vulnerable, allowing authenticated users with administrative access to execute arbitrary commands.
Description
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command.
Exploits (1)
The exploit demonstrates arbitrary command execution in XCloner WordPress/Joomla! backup plugin due to unsanitized user input passed to exec() functions. Multiple input fields are vulnerable, allowing authenticated users with administrative access to execute arbitrary commands.