Vulnerabilities > CVE-2014-8749 - Unspecified vulnerability in Ait-Pro Bulletproof Security

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
low complexity
ait-pro
NVD
Published: 2014-12-01
Updated: 2014-12-01

Summary

Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter. <a href="http://cwe.mitre.org/data/definitions/918.html">CWE-918: Server-Side Request Forgery (SSRF)</a>

Vulnerable Configurations

Part Description Count
Application
Ait-Pro
63

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/128977/wpbulletproofsecurity-ssrfxsssql.txt
idPACKETSTORM:128977
last seen2016-12-05
published2014-11-05
reporterPietro Oliva
sourcehttps://packetstormsecurity.com/files/128977/WordPress-Bulletproof-Security-.51-XSS-SQL-Injection-SSRF.html
titleWordPress Bulletproof-Security .51 XSS / SQL Injection / SSRF

References