CVE-2007-2483 - Directory traversal vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin f

CVE-2007-2483

Summary

Directory traversal vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the wpPATH parameter. Successful exploitation requires that register_globals is enabled.

References

Vulnerable Configurations

cpe:2.3:a:ruben_boelinger:wp-table:*:*:*:*:*:*:*:*
cpe:2.3:a:ruben_boelinger:wp-table:*:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 16-10-2018 - 16:44)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bugtraq	20070502 [ECHO_ADV_82$2007] wordpress plugins wp-Table <= 1.43 (wpPATH) Remote File Inclusion Vulnerability
confirm	http://alexrabe.boelinger.com/
exploit-db	3824
misc	http://advisories.echo.or.id/adv/adv82-K-159-2007.txt
osvdb	37297
secunia	25063
vupen	ADV-2007-1614
xf	wptable-button-file-include(33989)

Last major update

16-10-2018 - 16:44

Published

03-05-2007 - 17:19

Last modified

16-10-2018 - 16:44