CVE-2015-4616 Easy2Map <= 1.2.4 - Directory Traversal
MediumCVSS 5.0
EPSS 10.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary files via a .. (dot dot) in the map_id parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| easy2map project easy2map | <= 1.2.4 | No fix listed |
| wordpress easy2map(WordPress) | < 1.2.5 | 1.2.5 |
References
- 20150703 SQL Injection in easy2map wordpress plugin v1.24 exploit mailing-list
- 20150702 SQL Injection in easy2map wordpress plugin v1.24 mailing-list
- www.vapid.dhs.org
- plugins.trac.wordpress.org
- 37534 exploit
- Wordfence Intelligence third-party-advisory
- www.cve.org