CVE-2015-8351
CVE-2015-8351
Vexday Risk Score
57Atención
Decisión SSVC (CISA)
Act
Explotación + impacto → acción inmediata
Madurez del exploit
Prueba de concepto
PoC popular en GitHub (2 estrellas) — código de explotación ampliamente disponible.
CVSS —EPSS 37.0%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Ciclo de vida
03 dic 2015PoC pública
11 sep 2017Publicada en NVD
Recomendación: Corregir cuanto antes — hay explotación activa confirmada.
PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.
Productos afectados
n/a · n/aPoCs públicas encontradas — 9
githubgithub.com/G4sp4rCS/exploit-CVE-2015-8351★ 2githubgithub.com/G01d3nW01f/CVE-2015-8351★ 1githubgithub.com/Philip-Otter/CVE-2015-8351_Otter_Remix★ 0vulncheckvulncheck.com/xdb/89caab149253no verificadovulncheckvulncheck.com/xdb/d64fb0a650d9no verificadocve_referencepacketstormsecurity.com/files/134599/WordPress-Gwolle-Guestbook-1.5.3-Remote-File-Inclusion.htmlno verificadovulncheckvulncheck.com/xdb/3e43823dbfa9no verificadocve_referencewww.exploit-db.com/exploits/38861/no verificadoexploitdbwww.exploit-db.com/exploits/38861no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/134599/WordPress-Gwolle-Guestbook-1.5.3-Remote-File-Inclusion.htmlhttps://wordpress.org/plugins/gwolle-gb/changelog/https://www.exploit-db.com/exploits/38861/https://www.htbridge.com/advisory/HTB23275http://www.securityfocus.com/archive/1/537020/100/0/threaded