CVE-2013-5962
Summary
| CVE | CVE-2013-5962 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2013-09-30 22:55:03 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/. |
Risk And Classification
Primary CVSS: v2.0 5.1 from [email protected]
AV:N/AC:H/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:H/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Envato | Complete Gallery Manager Plugin | 1.0.0 | rev25273 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 1.0.1 | rev25421 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 1.0.2 | rev25487 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 2.0.0 | rev27524 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 2.0.1 | rev27876 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 2.0.2 | rev28693 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 2.0.3 | rev28734 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.0.0 | rev29469 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.0.1 | rev29536 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.1.0 | rev30003 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.1.1 | rev30900 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.2.0 | rev31030 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.2.1 | rev33197 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.2.2 | rev33971 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.2.3 | rev34390 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.2.4 | rev34757 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.2.5 | rev34942 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.2.6 | rev36235 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.2.7 | rev36257 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.2.8 | rev36369 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.3.0 | rev36620 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.3.1 | rev38906 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | 3.3.2 | rev39009 | All | All |
| Application | Envato | Complete Gallery Manager Plugin | All | rev39177 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| 403 Forbidden | af854a3a-2127-422b-91ae-364da2661108 | www.vulnerability-lab.com | Exploit |
| WordPress Complete Gallery Manager 3.3.3 File Upload ≈ Packet Storm | af854a3a-2127-422b-91ae-364da2661108 | packetstormsecurity.com | Exploit |
| Wordpress Plugin Complete Gallery Manager 3.3.3 - Arbitrary File Upload Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.exploit-db.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| WordPress - Complete Gallery Manager for WordPress | CodeCanyon | af854a3a-2127-422b-91ae-364da2661108 | codecanyon.net | |
| archives.neohapsis.com/archives/bugtraq/2013-09/0090.html | af854a3a-2127-422b-91ae-364da2661108 | archives.neohapsis.com | Exploit |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.