CVE-2022-1390
Summary
| CVE | CVE-2022-1390 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-04-25 16:16:00 UTC |
| Updated | 2022-05-04 13:48:00 UTC |
| Description | The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Admin Word Count Column Project | Admin Word Count Column | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| WordPress Admin Word Count Column 2.2 Local File Inclusion ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Attention Required! | Cloudflare | MISC | wpscan.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Hassan Khan Yusufzai - Splint3r7
There are currently no legacy QID mappings associated with this CVE.