CVE-2014-8754 WordPress “Ad-Manager Plugin" Dest Redirect Privilege Escalation

CVE-2014-8754 WordPress “Ad-Manager Plugin" Dest Redirect Privilege Escalation

 

 

Exploit Title: WordPress Ad-Manager Plugin Dest Redirect Privilege Escalation Vulnerability

Product: WordPress Ad-Manager Plugin

Vendor: CodeCanyon

Vulnerable Versions: 1.1.2

Tested Version: 1.1.2

Advisory Publication: Nov 25, 2014

Latest Update: Nov 25, 2014

Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]

CVE Reference: CVE-2014-8754

CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend)

Impact Subscore: 4.9

Exploitability Subscore: 8.6

Credit: Wang Jing [SPMS, Nanyang Technological University, Singapore]

 

 

 

Advisory Details

 

(1) Product:

“WordPress Ad-Manager offers users a simple solution to implement advertising into their posts, their blog or any other WordPress page. Users can use pictures and images or HTML snippets like Google AdSense to incorporate advertising in an easy way."

 

(2) Vulnerability Details:

The Dest Redirect Privilege Escalation vulnerability occurs at “track-click.php" page with “&out" parameter.

 

 

 

 

 

 
References:
http://tetraph.com/security/cves/cve-2014-8754-wordpress-ad-manager-plugin-dest-redirect-privilege-escalation/
https://www.marshut.net/ksvthm/cve-2014-8754-wordpress-ad-manager-plugin-dest-redirect-privilege-escalation.html
http://www.cnnvd.org.cn/vulnerability/show/cv_id/2014110533
http://seclists.org/fulldisclosure/2014/Nov/93
http://www.osvdb.org/creditees/12822-wang-jing
http://mathswift.blogspot.com/2014/12/cve-2014-8754-wordpress-ad-manager.html
http://cxsecurity.com/issue/WLB-2014120003
http://www.cnvd.org.cn/flaw/show/CNVD-2014-08598

 

 

Leave a comment

你的電子郵件位址並不會被公開。 必要欄位標記為 *

你可以使用這些 HTML 標籤與屬性: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>