CVE-2014-8603

Severity CVSS v4.0:

Pending analysis

Type:

CWE-20 Input Validation

Publication date:

10/06/2015

Last modified:

12/04/2025

Description

cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG[&#39;tarcompress&#39;], (5) $_CONFIG[&#39;filename&#39;], (6) $_CONFIG[&#39;exfile_tar&#39;], (7) $_CONFIG[sqldump], (8) $_CONFIG[&#39;mysql_host&#39;], (9) $_CONFIG[&#39;mysql_pass&#39;], (10) $_CONFIG[&#39;mysql_user&#39;], (11) $database_name, or (12) $sqlfile variable.

Impact

Vector 2.0

AV:N/AC:L/Au:S/C:P/I:P/A:P CVSS v2.0 Severity and Metrics:

Base Score: 6.50 MEDIUM
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Attack Vector (AV): Network
Attack Complexity (AC): Low
Authentication (Au): Single
Confidentiality (C): Physical
Integrity (I): Physical
Availability (A): Physical