CVE-2014-8336 WP DB Manager < 2.7.2 - Arbitrary File Read
MediumCVSS 6.5
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT statement.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wp-dbmanager project wp-dbmanager | <= 2.7.1 | No fix listed |
| wordpress wp-dbmanager(WordPress) | < 2.7.2 | 2.7.2 |
References
- [oss-security] 20141021 Re: Vulnerabilities in WordPress Database Manager v2.7.1 issue-tracking mailing-list patch third-party-advisory
- www.vapid.dhs.org exploit third-party-advisory
- dbmgr-wordpress-cve20148336-file-download(97694) issue-tracking third-party-advisory vdb-entry
- github.com issue-tracking patch third-party-advisory
- wordpress.org third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org