Summaryinfo

A vulnerability labeled as critical has been found in Easy2Map Plugin up to 1.2.4 on WordPress. This impacts an unknown function of the file includes/MapPinImageSave.php. The manipulation of the argument map_id results in path traversal. This vulnerability was named CVE-2015-4616. In addition, an exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Easy2Map Plugin up to 1.2.4 on WordPress (WordPress Plugin). Affected is an unknown part of the file includes/MapPinImageSave.php. The manipulation of the argument map_id with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, and integrity. CVE summarizes:

Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary files via a .. (dot dot) in the map_id parameter.

The weakness was presented 07/08/2015 (Website). The advisory is available at plugins.trac.wordpress.org. This vulnerability is traded as CVE-2015-4616 since 06/16/2015. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

A public exploit has been developed by Larry W. Cashdollar and been published immediately after the advisory. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:includes/MapPinImageSave.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.2.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (37534). See VDB-76337 for similar entry. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Name

• Easy2Map Plugin

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion