← Retour aux CVEs

CVE-2020-9006

CRITICAL

9.8

Description

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie2/17/2020

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

sygnoos:popup_builder

Faiblesses (CWE)

CWE-89CWE-502

References

https://plugins.trac.wordpress.org/browser/popup-builder/tags/2.2.8/files/sg_popup_ajax.php#L69(cve@mitre.org)

https://wordpress.org/plugins/popup-builder/#developers(cve@mitre.org)

https://wpvulndb.com/vulnerabilities/10073(cve@mitre.org)

https://zeroauth.ltd/blog/2020/02/16/cve-2020-9006-popup-builder-wp-plugin-sql-injection-via-php-deserialization/(cve@mitre.org)

https://plugins.trac.wordpress.org/browser/popup-builder/tags/2.2.8/files/sg_popup_ajax.php#L69(af854a3a-2127-422b-91ae-364da2661108)

https://wordpress.org/plugins/popup-builder/#developers(af854a3a-2127-422b-91ae-364da2661108)

https://wpvulndb.com/vulnerabilities/10073(af854a3a-2127-422b-91ae-364da2661108)

https://zeroauth.ltd/blog/2020/02/16/cve-2020-9006-popup-builder-wp-plugin-sql-injection-via-php-deserialization/(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.