CVE-2019-15858
HIGH NUCLEIWoody ad snippets < 2.2.5 - Unauthenticated Options Import
Title source: llmExploitation Summary
EIP tracks 8 public exploits for CVE-2019-15858. PoCs published by GeneralEG, orangmuda. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2019-15858, targeting an unauthenticated remote code execution vulnerability in the WordPress Woody Ad Snippets plugin (versions 2.2.4 and below). The exploit leverages an options import vulnerability combined with stored XSS to achieve RCE.
Description
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
Exploits (8)
This repository contains a functional exploit for CVE-2019-15858, targeting an unauthenticated remote code execution vulnerability in the WordPress Woody Ad Snippets plugin (versions 2.2.4 and below). The exploit leverages an options import vulnerability combined with stored XSS to achieve RCE.
This repository contains a functional exploit for CVE-2019-15858, which combines an unauthenticated options import vulnerability with a stored XSS to achieve remote code execution in the WordPress Woody Ad Snippets plugin (versions 2.2.4 and below). The exploit uploads a malicious JSON payload to trigger the vulnerability and includes a JavaScript-based RCE payload for further exploitation.
This repository contains a functional exploit for CVE-2019-15858, which combines an unauthenticated options import vulnerability with a stored XSS to achieve remote code execution in the WordPress Woody Ad Snippets plugin (versions 2.2.4 and below). The exploit uploads a malicious JSON payload and leverages a JavaScript-based RCE to execute arbitrary PHP code.
This repository contains a functional exploit for CVE-2019-15858, targeting the Woody Ad Snippets WordPress plugin (versions 2.2.4 and below). The exploit combines an unauthenticated options import vulnerability with stored XSS to achieve remote code execution by uploading a malicious payload.
This repository contains a functional exploit for CVE-2019-15858, which combines an unauthenticated options import vulnerability with a stored XSS to achieve remote code execution in the WordPress Woody Ad Snippets plugin (versions 2.2.4 and below). The exploit uploads a malicious JSON payload to trigger the vulnerability and includes a JavaScript-based RCE payload for further exploitation.
This repository contains a functional exploit for CVE-2019-15858, which combines an unauthenticated options import vulnerability with a stored XSS to achieve remote code execution in the WordPress Woody Ad Snippets plugin (versions 2.2.4 and below). The exploit uploads a malicious JSON payload to trigger the vulnerability and includes a JavaScript-based RCE payload for further exploitation.
This repository contains a functional exploit for CVE-2019-15858, which combines an unauthenticated options import vulnerability with a stored XSS to achieve remote code execution in the WordPress Woody Ad Snippets plugin (versions 2.2.4 and below). The exploit uploads a malicious JSON payload to trigger the vulnerability and includes a JavaScript-based RCE payload for further exploitation.
This repository contains a functional exploit for CVE-2019-15858, targeting the Woody Ad Snippets WordPress plugin (versions 2.2.4 and below). The exploit combines an unauthenticated options import vulnerability with a stored XSS to achieve remote code execution by uploading a malicious JSON payload and leveraging a crafted JavaScript file to install a PHP backdoor.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H