Vulnerabilities > CVE-2018-7422 - Inclusion of Functionality from Untrusted Control Sphere vulnerability in Siteeditor Site Editor 1.0.0/1.1.0/1.1.1

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
siteeditor
CWE-829
exploit available
NVD
Published: 2018-03-19
Updated: 2020-08-24

Summary

A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.

Vulnerable Configurations

Part Description Count
Application
Siteeditor
3

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionWordpress Plugin Site Editor 1.1.1 - Local File Inclusion. CVE-2018-7422. Webapps exploit for PHP platform. Tags: File Inclusion (LFI/RFI)
fileexploits/php/webapps/44340.txt
idEDB-ID:44340
last seen2018-05-24
modified2018-03-23
platformphp
port80
published2018-03-23
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/44340/
titleWordpress Plugin Site Editor 1.1.1 - Local File Inclusion
typewebapps

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/146796/wpsiteeditor111-lfi.txt
idPACKETSTORM:146796
last seen2018-03-23
published2018-03-16
reporterNicolas Buzy-Debat
sourcehttps://packetstormsecurity.com/files/146796/WordPress-Site-Editor-1.1.1-Local-File-Inclusion.html
titleWordPress Site Editor 1.1.1 Local File Inclusion

References