CVE-2014-6446
Infusionsoft Gravity Forms Add-on 1.5.3 - 1.5.10 - Arbitrary File Upload
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
4
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
El plugin Infusionsoft Gravity Forms 1.5.3 hasta 1.5.10 para WordPress no restringe debidamente el acceso, lo que permite a atacantes remotos subir ficheros arbitrarios y ejecutar código PHP arbitrario a través de una solicitud en utilities/code_generator.php.
*Credits:
James Hooker,us3r777
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2014-09-16 CVE Reserved
- 2014-09-26 CVE Published
- 2014-10-09 First Exploit
- 2024-08-06 CVE Updated
- 2024-08-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/show/osvdb/112171 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/34925 | 2014-10-09 | |
| http://packetstormsecurity.com/files/131002/Wordpress-InfusionSoft-Shell-Upload.html | 2024-08-06 | |
| http://research.g0blin.co.uk/cve-2014-6446 | 2024-08-06 | |
| http://www.exploit-db.com/exploits/34925 | 2024-08-06 |
| URL | Date | SRC |
|---|---|---|
| https://wordpress.org/plugins/infusionsoft/changelog | 2015-10-01 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.3 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.3" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.4 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.4" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.4.1 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.4.1" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.4.2 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.4.2" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.5 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.5" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.6 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.6" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.7 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.7" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.7.1 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.7.1" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.7.2 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.7.2" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.8 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.8" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.8.1 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.8.1" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.9 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.9" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.9.1 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.9.1" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.9.2 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.9.2" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.9.3 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.9.3" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.9.4 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.9.4" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.9.5 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.9.5" | wordpress |
Affected
| ||||||
| Infusionsoft Gravity Forms Project Search vendor "Infusionsoft Gravity Forms Project" | Infusionsoft Gravity Forms Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" | 1.5.10 Search vendor "Infusionsoft Gravity Forms Project" for product "Infusionsoft Gravity Forms" and version "1.5.10" | wordpress |
Affected
| ||||||