CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 3CVE-2014-8603 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2014-8603
cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG['tarcompress'], (5) $_CONFIG['filename'], (6) $_CONFIG['exfile_tar'], (7) $_CONFIG[sqldump], (8) $_CONFIG['mysql_host'], (9) $_CONFIG['mysql_pass'], (10) $_CONFIG['mysql_user'], (11) $database_name, or (12) $sqlfile variable. cloner.functions.php en el plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! permite a administradores remotos ejecutar código arbitrario a través de metacaracteres de shell en (1) el nombre de fichero cuando crea una copia de seguridad o vectores relacionados con la variable (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG['tarcompress'], (5) $_CONFIG['filename'], (6) $_CONFIG['exfile_tar'], (7) $_CONFIG[sqldump], (8) $_CONFIG['mysql_host'], (9) $_CONFIG['mysql_pass'], (10) $_CONFIG['mysql_user'], (11) $database_name o (12) $sqlfile. XCloner plugin version 3.1.1 for WordPress and 3.5.1 for Joomla! suffers from arbitrary command execution, MySQL password disclosure, database backups exposed, unauthenticated remote access, and various other vulnerabilities. • https://www.exploit-db.com/exploits/35212 http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 http://www.vapid.dhs.org/advisory.php?v=110 • CWE-20: Improper Input Validation CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 3CVE-2014-8605 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Improper Access Control to Information Disclosure
https://notcve.org/view.php?id=CVE-2014-8605
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/. El plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! almacena ficheros de copias de seguridad de la base de datos con nombres previsibles bajo el root web con un control de acceso insuficiente, lo que permite a atacantes remotos obtener información sensible a través de una solicitud directa a un fichero de copias de seguridad en administrators/backups/. XCloner plugin version 3.1.1 for WordPress and 3.5.1 for Joomla! • https://www.exploit-db.com/exploits/35212 http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 http://www.vapid.dhs.org/advisory.php?v=110 • CWE-264: Permissions, Privileges, and Access Controls CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 3CVE-2014-8604 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2014-8604
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remote attackers to obtain sensitive information via unspecified vectors. El plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! devuelve la contraseña MySQL en texto plano al cuadro de texto en el panel de configuración, lo que permite a atacantes remotos obtener información sensible a través de vectores no especificados. XCloner plugin version 3.1.1 for WordPress and 3.5.1 for Joomla! • https://www.exploit-db.com/exploits/35212 http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 http://www.vapid.dhs.org/advisory.php?v=110 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 3CVE-2014-2996 – XCloner Standalone 3.5 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2014-2996
XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code. NOTE: this can be leveraged by remote attackers using CVE-2014-2579. XCloner Standalone 3.5 y anteriores, cuando enable_db_backup y sql_mem están habilitados, permite a administradores remotos autenticados ejecutar comandos arbitrarios a través de metacaracteres de shell en el parámetro dbbackup_comp en una acción generate hacia index2.php. NOTA: ino está claro si este problema cruza límites de privilegio, como administradores podrían ya tener los privilegios para ejecutar código. • https://www.exploit-db.com/exploits/32790 http://www.exploit-db.com/exploits/32790 http://www.securityfocus.com/archive/1/531780/100/0/threaded https://www.htbridge.com/advisory/HTB23207 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 3CVE-2014-2579 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Multiple Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2014-2579
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin. NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands. Múltiples vulnerabilidades de CSRF en XCloner Standalone 3.5 y anteriores permiten a atacantes remotos secuestrar la autenticación de administradores para solicitudes que (1) cambian la contraseña de administrador a través de la tarea config hacia index2.php o (2) cuando las opciones enable_db_backup y sql_mem están habilitadas, acceder a la funcionalidad de copia de seguridad de la base de datos a través del parámetro dbbackup_comp en la acción generate hacia index2.php. NOTA: vector 2 podría ser un duplicado de CVE-2014-2340, lo que es para el plugin XCloner Wordpress. • https://www.exploit-db.com/exploits/32790 http://www.exploit-db.com/exploits/32790 http://www.securityfocus.com/archive/1/531780/100/0/threaded http://www.securityfocus.com/bid/66751 https://www.htbridge.com/advisory/HTB23207 • CWE-352: Cross-Site Request Forgery (CSRF) •