CVE-2020-10257

CRITICALNuclei

themerex addons Improper Control of Generation of Code ('Code Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2020-10257 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 9, 2020 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

addons

Browse themerex / addons
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALThemeREX Addons - Remote Code ExecutionCVSS 9.8

ThemeREX Addons plugin before 2020-03-09 for WordPress contains an access control vulnerability in the /trx_addons/v2/get/sc_layout REST API endpoint, allowing any users to execute PHP functions because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter, letting attackers execute arbitrary PHP functions, exploit requires no authentication.

Impact

Unauthenticated attackers can execute arbitrary PHP functions, potentially leading to remote code execution and full site compromise.

Remediation

Update to version 2020-03-09 or later to fix access control issues.

WeaknessesCWE-94
Authorstheamanrawat
Template tagscvecve2020rcewordpresswp-pluginwpthemerexunauthvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:themerex:addons:1.70.3:*:*:*:*:wordpress:*:*
Shodan: http.html:trx_addons
FOFA: body=trx_addons
https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/ https://wpscan.com/vulnerability/4ed4e60e-5bbb-4010-a7fe-40eadd8dee64/ https://nvd.nist.gov/vuln/detail/CVE-2020-10257

Source: ProjectDiscovery

References

2