CVE-2021-25082

HIGHNuclei

Popup Builder < 4.0.7 - LFI to RCE

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-25082 has a selected CVSS score of 8.8 (high); EIP currently links 1 Nuclei template.

Description

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 19, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Popup Builder – Create highly converting, mobile friendly marketing popups.

CVE List4.0.7 to < 4.0.7affected

popup_builder

Browse sygnoos / popup_builder
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Popup Builder < 4.0.7 - Remote Code ExecutionCVSS 8.8

Popup Builder WordPress plugin before 4.0.7 contains a local file inclusion caused by unsanitized 'sgpb_type' parameter in require statement, letting attackers include arbitrary local files or execute code via wrappers like PHAR, exploit requires attacker to control 'sgpb_type' parameter.

Impact

Attackers can include arbitrary local files or execute code remotely, leading to remote code execution and full site compromise.

Remediation

Update to version 4.0.7 or later

WeaknessesCWE-98
Authors0x_Akoko
Template tagscvecve2021wordpresswp-pluginrcepopup-builderauthenticatedvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
https://wpscan.com/vulnerability/0f90f10c-4b0a-46da-ac1f-aa6a03312132/ https://nvd.nist.gov/vuln/detail/CVE-2021-25082

Source: ProjectDiscovery

References

3