WordPress Plugin Vulnerabilities

System Dashboard < 2.8.15 - Admin+ Path Traversal

Description

The plugin does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server

Proof of Concept

Affects Plugins

Plugin icon
system-dashboard
Fixed in 2.8.15

References

CVE
CVE-2024-10708

Classification

Type
TRAVERSAL
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
4.9 (medium)

Miscellaneous

Original Researcher
Dogus DEMIRKIRAN
Submitter
Dogus DEMIRKIRAN
Verified
Yes
WPVDB ID
61d750a5-8c2c-4c94-a1a9-6a254c2a0d03

Timeline

Publicly Published
2024-11-19 (about 1 year ago)
Added
2024-11-19 (about 1 year ago)
Last Updated
2024-11-19 (about 1 year ago)

Other

Published
Title
Published
2021-01-15
Title
Simple Job Board < 2.9.4 - Authenticated Path Traversal Leading to Arbitrary File Download
Published
2019-01-25
Title
Health Check & Troubleshooting <= 1.2.3 - Authenticated Path Traversal
Published
2023-03-20
Title
Hummingbird < 3.4.2 - Unauthenticated Path Traversal
Published
2023-11-13
Title
Frontend File Manager < 22.7 - Editor+ Arbitrary File Download
Published
2022-09-14
Title
Enable Media Replace < 4.0.0 - Admin+ Path Traversal