CVE-2023-2359

Published: Jun 19, 2023Modified: Dec 12, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations.

Affected (1)

Products: Themepunch: Slider Revolution

Themepunch

1 product

Slider Revolution

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Themepunch Slider Revolution	Up to 6.6.12

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (3)

https://wpscan.com/vulnerability/a8350890-e6d4-4b04-a158-2b0ee3748e65

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/a8350890-e6d4-4b04-a158-2b0ee3748e65

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://wpscan.com/vulnerability/a8350890-e6d4-4b04-a158-2b0ee3748e65/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.