CVE-2009-2852
WP Syntax < 0.9.10 - Remote Code Execution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.
WP-Syntax plugin v0.9.1 y anteriores de Wordpress, que activan register_globals, permiten a atacantes remotos ejecutar código PHP a su elección a través del parámetro del array test_filter[wp_head]de test/index.php, que es usado en la llamada a la función call_user_func_array.
WP-Syntax plugin 0.9.9 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-04-13 CVE Published
- 2009-08-18 CVE Reserved
- 2009-08-27 First Exploit
- 2024-03-28 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.vupen.com/english/advisories/2009/2456 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/52457 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/9431 | 2009-08-27 | |
| http://www.exploit-db.com/exploits/9431 | 2024-08-07 | |
| http://www.securityfocus.com/bid/36040 | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ryan.mcgeary Search vendor "Ryan.mcgeary" | Wp-syntax Search vendor "Ryan.mcgeary" for product "Wp-syntax" | <= 0.9.1 Search vendor "Ryan.mcgeary" for product "Wp-syntax" and version " <= 0.9.1" | - |
Affected
| in | Wordpress Search vendor "Wordpress" | Wordpress Search vendor "Wordpress" for product "Wordpress" | * | - |
Safe
|