CVE-2021-25082

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://plugins.trac.wordpress.org/changeset/2659117	Release Notes Third Party Advisory
https://wpscan.com/vulnerability/0f90f10c-4b0a-46da-ac1f-aa6a03312132	Exploit Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2659117	Release Notes Third Party Advisory
https://wpscan.com/vulnerability/0f90f10c-4b0a-46da-ac1f-aa6a03312132	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2022-02-21 11:15

Updated : 2024-11-21 05:54

NVD link : CVE-2021-25082

Mitre link : CVE-2021-25082

CVE.ORG link : CVE-2021-25082

JSON object : View

Products Affected

sygnoos

popup_builder

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2021-25082", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-02-21T11:15:08.757", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/2659117", "tags": ["Release Notes", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/0f90f10c-4b0a-46da-ac1f-aa6a03312132", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/2659117", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wpscan.com/vulnerability/0f90f10c-4b0a-46da-ac1f-aa6a03312132", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR"}, {"lang": "es", "value": "El plugin Popup Builder de WordPress versiones anteriores a 4.0.7, no comprueba ni sanea el par\u00e1metro sgpb_type antes de usarlo en una sentencia require, lo que conlleva un problema de inclusi\u00f3n de archivos locales. Adem\u00e1s, dado que el comienzo de la cadena puede ser controlado, el problema puede conllevar a una vulnerabilidad RCE por medio de wrappers como PHAR"}], "lastModified": "2024-11-21T05:54:18.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "4D698325-F34E-4DA6-A031-6B0814E68705", "versionEndExcluding": "4.0.7"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}