WordPress Ad-Manager 1.1.2 Open Redirect

2014.12.01
Credit: Wang Jing
Risk: Low
Local: No
Remote: Yes
CWE: CWE-601


CVSS Base Score: 5.8/10
Impact Subscore: 4.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: None

<http://tetraph.com/security/open-redirect/cve-2014-8754-wordpress-ad-manager-plugin-dest-redirect-privilege-escalation/#respond> *CVE-2014-8754 WordPress ?Ad-Manager Plugin? Dest Redirect Privilege Escalation* Exploit Title: WordPress Ad-Manager Plugin Dest Redirect Privilege Escalation Vulnerability Product: WordPress Ad-Manager Plugin Vendor: CodeCanyon Vulnerable Versions: 1.1.2 Tested Version: 1.1.2 Advisory Publication: Nov 25, 2014 Latest Update: Nov 25, 2014 Vulnerability Type: URL Redirection to Untrusted Site [CWE-601] CVE Reference: CVE-2014-8754 CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend) Impact Subscore: 4.9 Exploitability Subscore: 8.6 Credit: Wang Jing [SPMS, Nanyang Technological University, Singapore] *Advisory Details* *(1) Product:* ?WordPress Ad-Manager offers users a simple solution to implement advertising into their posts, their blog or any other WordPress page. Users can use pictures and images or HTML snippets like Google AdSense to incorporate advertising in an easy way.? *(2) Vulnerability Details:* The Dest Redirect Privilege Escalation vulnerability occurs at ?track-click.php? page with ?&out? parameter. *References:* http://tetraph.com/security/cves/cve-2014-8754-wordpress-ad-manager-plugin-dest-redirect-privilege-escalation/ http://codecanyon.net/item/wordpress-admanager/544421 https://wordpress.org/plugins/ad-manager-for-wp/ http://cwe.mitre.org http://cve.mitre.org/

References:

http://tetraph.com/security/cves/cve-2014-8754-wordpress-ad-manager-plugin-dest-redirect-privilege-escalation/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top