Vulnerability Details : CVE-2012-1125
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the directory specified by the folder parameter.
Vulnerability category: Execute code
Exploit prediction scoring system (EPSS) score for CVE-2012-1125
Probability of exploitation activity in the next 30 days: 4.15%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 92 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-1125
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
References for CVE-2012-1125
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/79563
Kish Guest Posting plugin for WordPress uploadify file upload CVE-2012-1125 Vulnerability Report
-
http://archives.neohapsis.com/archives/bugtraq/2012-01/0145.html
Exploit
-
http://plugins.svn.wordpress.org/kish-guest-posting/trunk/readme.txt
-
http://www.exploit-db.com/exploits/18412
WordPress Plugin Kish Guest Posting 1.0 - Arbitrary File Upload - PHP webapps ExploitExploit
-
http://www.openwall.com/lists/oss-security/2012/03/08/1
oss-security - Re: CVE-request: Kish Guest Posting Plugin for WordPress File Upload Remote PHP Code Execution
-
http://plugins.trac.wordpress.org/changeset/403694/kish-guest-posting/trunk/uploadify/scripts/uploadify.php
Changeset 403694 for kish-guest-posting/trunk/uploadify/scripts/uploadify.php – WordPress Plugin Repository
-
http://www.securityfocus.com/bid/51638
WordPress Guest Posting Plugin 'uploadify.php' Arbitrary File Upload VulnerabilityExploit
-
http://www.openwall.com/lists/oss-security/2012/03/06/3
oss-security - CVE-request: Kish Guest Posting Plugin for WordPress File Upload Remote PHP Code Execution
-
http://www.openwall.com/lists/oss-security/2012/03/06/11
oss-security - Re: CVE-request: Kish Guest Posting Plugin for WordPress File Upload Remote PHP Code Execution
Products affected by CVE-2012-1125
- cpe:2.3:a:kishore_asokan:kish_guest_posting_plugin:*:*:*:*:*:*:*:*
- cpe:2.3:a:kishore_asokan:kish_guest_posting_plugin:1.0:*:*:*:*:*:*:*