actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote...
Vulnerability Description
actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-1011
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.exploit-db.com/exploits/18407
- http://www.securityfocus.com/bid/51615
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72640
- http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog/
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html
- http://secunia.com/advisories/47659
Affected Vendor
likno
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.