Published: 30/06/2015 Updated: 01/07/2015

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 510

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Directory traversal vulnerability in the Slider Revolution (revslider) plugin prior to 4.2 for WordPress allows remote malicious users to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
themepunch slider revolution

This NSE script for Nmap exploits a directory traversal in WordPress Elegant Themes Divi Theme ...

# Exploit Title : WordPress Slider Revolution Responsive <= 414 Arbitrary File Download vulnerability # Exploit Author : Claudio Viviani # Vendor Homepage : codecanyonnet/item/slider-revolution-responsive-wordpress-plugin/2751380 # Software Link : Premium plugin # Dork Google: revsliderphp "index of" # Date : 2014 ...

# WordPress CuckooTap Theme & eShop Arbitrary File Download # Risk: High # CWE number: CWE-200 # Author: Hugo Santiago # Contact: hugos@linuxmailorg # Date: 31/08/2014 # Vendor Homepage: themeforestnet/item/cuckootap-one-page-parallax-wp-theme-plus-eshop/3512405 # Tested on: Windows 7 and Gnu/Linux # Google Dork: "Index of" +/wp-conte ...

CWE-22 http://marketblog.envato.com/news/plugin-vulnerability/http://packetstormsecurity.com/files/132366/WordPress-Revslider-4.2.2-XSS-Information-Disclosure.html https://blog.sucuri.net/2014/12/revslider-vulnerability-leads-to-massive-wordpress-soaksoak-compromise.html https://plugins.trac.wordpress.org/browser/patch-for-revolution-slider/trunk/revsliderpatch.php https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html http://marketblog.envato.com/news/affected-themes/http://www.exploit-db.com/exploits/34511 https://nvd.nist.gov https://packetstormsecurity.com/files/142064/WordPress-Elegant-Themes-Divi-Theme-Directory-Traversal-Nmap-NSE-Script.html https://www.exploit-db.com/exploits/36554/

CVE-2014-9734

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect