CVE-2014-1610

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 43%

from disclosure to weapon2 days

Published on NVDJan 30

1st PoC+2d

metasploitJan 28

exploitation probability

43%top 1% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencewww.exploit-db.com/exploits/31329/unverified exploitdbwww.exploit-db.com/exploits/31767unverified exploitdbwww.exploit-db.com/exploits/31329unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html http://osvdb.org/102630 https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff https://bugzilla.wikimedia.org/show_bug.cgi?id=60339 http://secunia.com/advisories/56695 http://secunia.com/advisories/57472 https://gerrit.wikimedia.org/r/#/c/110069/https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php https://gerrit.wikimedia.org/r/#/c/110215/