CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 3CVE-2012-1011 – AllWebMenus WordPress Menu Plugin <= 1.1.8 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2012-1011
actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory. actions.php en el complemento AllWebMenus v1.1.8 para WordPress, permite a atacantes remotos evitar restricciones de acceso intencionadas para subir y ejecutar código PHP de su elección estableciendo el HTTP_REFERER a un determinado valor, subiendo un archivo ZIP que contenga el archivo PHP y accediendo a este a través de una petición directa al archivo en un directorio no especificado. The "AllWebMenus WordPress Menu Plugin" plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the actions.php file in versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. In versions 1.1.8, it's required to set the HTTP_REFERER to a certain value in order to bypass the referer protection added in v1.1.8. • https://www.exploit-db.com/exploits/18407 http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html http://secunia.com/advisories/47659 http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog http://www.exploit-db.com/exploits/18407 http://www.securityfocus.com/bid/51615 https://exchange.xforce.ibmcloud.com/vulnerabilities/72640 • CWE-264: Permissions, Privileges, and Access Controls CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 1%CPEs: 23EXPL: 3CVE-2012-1010 – AllWebMenus WordPress Menu Plugin < 1.1.9 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2012-1010
Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory. Subida de ficheros sin restricción en actions.php en el complemento AllWebMenus antes de v1.1.8 para WordPress, permite a atacantes remotos ejecutar código PHP de su elección subiendo un archivo ZIP que contenga el archivo PHP y accediendo a este a través de una petición directa al archivo en un directorio no especificado. Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.9 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory. • https://www.exploit-db.com/exploits/18407 http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html http://secunia.com/advisories/47659 http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog http://www.exploit-db.com/exploits/18407 http://www.securityfocus.com/bid/51615 https://exchange.xforce.ibmcloud.com/vulnerabilities/72640 • CWE-20: Improper Input Validation CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 2CVE-2011-3981 – AllWebMenus WordPress Menu Plugin <= 1.1.3 - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2011-3981
PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter. Vulnerabilidad de inclusión de PHP remoto en actions.php en el plugin AllWebMenus v1.1.3 para WordPress. Permite a atacantes remotos ejecutar código PHP arbitrario a través de una URL en el parámetro abspath. • https://www.exploit-db.com/exploits/17861 http://plugins.trac.wordpress.org/changeset/438959/allwebmenus-wordpress-menu-plugin/trunk/actions.php?old=408304&old_path=allwebmenus-wordpress-menu-plugin%2Ftrunk%2Factions.php http://secunia.com/advisories/46068 http://www.exploit-db.com/exploits/17861 http://www.securityfocus.com/bid/49685 https://exchange.xforce.ibmcloud.com/vulnerabilities/69929 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •