StageShow Plugin up to 5.0.8 on WordPress stageshow_redirect.php Redirect url
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
7.0 | $0-$5k | 0.00 |
A vulnerability, which was classified as critical, was found in StageShow Plugin up to 5.0.8 on WordPress (WordPress Plugin). Affected is the function Redirect
of the file stageshow_redirect.php. The manipulation of the argument url
with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
The weakness was published 07/08/2015 (Website). The advisory is available at wordpress.org. This vulnerability is traded as CVE-2015-5461 since 07/08/2015. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1204.001 by the MITRE ATT&CK project.
By approaching the search of inurl:stageshow_redirect.php it is possible to find vulnerable targets with Google Hacking.
Upgrading to version 5.0.9 eliminates this vulnerability.
Product
Type
Name
Version
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.3VulDB Meta Temp Score: 7.0
VulDB Base Score: 7.3
VulDB Temp Score: 7.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: RedirectCWE: CWE-601
ATT&CK: T1204.001
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
Google Hack: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: StageShow Plugin 5.0.9
Timeline
07/05/2015 🔍07/05/2015 🔍
07/08/2015 🔍
07/08/2015 🔍
07/08/2015 🔍
07/09/2015 🔍
07/29/2015 🔍
05/23/2022 🔍
Sources
Advisory: 132553Status: Not defined
Confirmation: 🔍
CVE: CVE-2015-5461 (🔍)
Vulnerability Center: 51661 - StageShow Plugin before 5.0.9 for WordPress Remote Open Redirect Vulnerability via a URL, Medium
SecurityFocus: 75552 - WordPress StageShow Plugin 'stageshow_redirect.php' Open Redirection Vulnerability
Entry
Created: 07/09/2015 09:51Updated: 05/23/2022 17:55
Changes: 07/09/2015 09:51 (52), 08/03/2017 03:33 (10), 05/23/2022 17:55 (3)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.