CVSS: 9.1EPSS: 0%CPEs: 10EXPL: 1CVE-2021-24220 – All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion
https://notcve.org/view.php?id=CVE-2021-24220
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code. Thrive "Legacy" Rise by Thrive Themes de WordPress versiones anteriores a 2.0.0, Luxe para el tema Thrive Themes WordPress versiones anteriores a 2.0.0, Minus para el tema Thrive Themes WordPress versiones anteriores a 2.0.0, Ignition para el tema Thrive Themes WordPress versiones anteriores a 2.0.0, FocusBlog para el tema Thrive Themes WordPress versiones anteriores a 2.0.0, Squared para el tema Thrive Themes WordPress versiones anteriores a 2.0.0, el tema Voice WordPress versiones anteriores a 2.0.0, Performag para el tema Thrive Themes WordPress versiones anteriores a 2.0.0, Pressive para el tema Thrive Themes WordPress versiones anteriores a 2.0.0, Storied para el tema Thrive Themes WordPress versiones anteriores a 20.0, registra un endpoint de la API REST para comprimir imágenes utilizando el motor de optimización de imágenes Kraken. Al suministrar una petición diseñada en combinación con los datos insertados usando la vulnerabilidad de Actualización de Opciones, era posible utilizar este endpoint para recuperar código malicioso de una URL remota y sobrescribir un archivo existente en el sitio con él o crear un nuevo archivo. Esto incluye archivos PHP ejecutables que contienen código malicioso • https://wpscan.com/vulnerability/a2424354-2639-4f53-a24f-afc11f6c4cac https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wild • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 97%CPEs: 2EXPL: 26CVE-2021-3129 – Laravel Ignition File Upload Vulnerability
https://notcve.org/view.php?id=CVE-2021-3129
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2. Ignition versiones anteriores a 2.5.2, como es usado en Laravel y otros productos, permite a atacantes remotos no autenticados ejecutar código arbitrario debido a un uso no seguro de las funciones file_get_contents() y file_put_contents(). Esto es explotable en sitios que usan el modo de depuración con Laravel versiones anteriores a 8.4.2 Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents(). • https://www.exploit-db.com/exploits/49424 https://github.com/zhzyker/CVE-2021-3129 https://github.com/SNCKER/CVE-2021-3129 https://github.com/joshuavanderpoll/CVE-2021-3129 https://github.com/SecPros-Team/laravel-CVE-2021-3129-EXP https://github.com/knqyf263/CVE-2021-3129 https://github.com/Y0s9/CVE-2021-3129 https://github.com/FunPhishing/Laravel-8.4.2-rce-CVE-2021-3129 https://github.com/Axianke/CVE-2021-3129 https://github.com/shadowabi/Laravel-CVE-2021-3129 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-13909
https://notcve.org/view.php?id=CVE-2020-13909
The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix. El componente Ignition anterior a la versión 2.0.5 para Laravel maneja mal los globals, _get, _post, _cookie y _env. NOTA: en la serie 1.x, las versiones 1.16.15 y posteriores no están afectadas como consecuencia de la corrección de CVE-2021-43996. • https://github.com/facade/ignition/compare/2.0.4...2.0.5 https://github.com/facade/ignition/releases/tag/2.0.5 •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 5CVE-2009-4426 – Ignition 1.2 - Multiple Local File Inclusions
https://notcve.org/view.php?id=CVE-2009-4426
Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the blog parameter to (1) comment.php and (2) view.php. Múltiples vulnerabilidades de salto de directorio en Ignition v1.2, cuando está deshabilitado magic_quotes_gpc, permite a atacantes remotos incluir y ejecutar ficheros de su elección mediante los caracteres .. (punto punto) en el parámetro "blog" en (1) comment.php y (2) view.php. • https://www.exploit-db.com/exploits/10569 http://osvdb.org/61225 http://osvdb.org/61226 http://packetstormsecurity.org/0912-exploits/ignition-lfi.txt http://secunia.com/advisories/37836 http://www.exploit-db.com/exploits/10569 https://exchange.xforce.ibmcloud.com/vulnerabilities/54940 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •