Description

WordPress Plugin Crayon Syntax Highlighter is prone to a remote file include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue could allow an attacker to compromise the application and the underlying system; other attacks are also possible. WordPress Plugin Crayon Syntax Highlighter version 1.12.1 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.13 or latest

References

http://www.securityfocus.com/bid/55919/exploit

http://ceriksen.com/2012/10/15/wordpress-crayon-syntax-highlighter-remote-file-inclusion-vulnerability/

http://secunia.com/advisories/50804/

Related Vulnerabilities

WordPress Plugin Download Monitor 'dlsearch' Parameter Cross-Site Scripting (3.3.5.8)

WordPress Plugin Web to Print Online Designer Security Bypass (2.3.0)

WordPress Plugin Swim Team Arbitrary File Download (1.44.1077)

WebLogic Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression La Vulnerability (CVE-2021-28170)

Piwigo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-8089)

Severity

High

Classification

CWE-94 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update File Inclusion