CVE-2024-9162 Vulnerability Details

  /     /     /  

CVE-2024-9162 Metadata Quick Info

CVE Published: 28/10/2024 | CVE Updated: 28/10/2024 | CVE Year: 2024
Source: Wordfence | Vendor: yaniiliev | Product: All-in-One WP Migration and Backup
Status : PUBLISHED

---

CVE-2024-9162 Description

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and including, 7.86. This makes it possible for authenticated attackers, with Administrator-level access and above, to create an export file with the .php extension on the affected site\'s server, adding an arbitrary PHP code to it, which may make remote code execution possible.

Metrics

CVSS Version: 3.1 | Base Score: 7.2 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-94
CWE Name: CWE-94 Improper Control of Generation of Code ( Code Injection )
Source: yaniiliev

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).