Description

WordPress Plugin Tera Charts is prone to multiple local file inclusion vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Tera Charts version 0.1 is vulnerable.

Remediation

Update to plugin version 1.0 or latest

References

https://codevigilant.com/disclosure/wp-plugin-tera-chart-local-file-inclusion/

http://www.securityfocus.com/bid/68662/exploit

Related Vulnerabilities

Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-5342)

MySQL CVE-2024-21243 Vulnerability (CVE-2024-21243)

MySQL Other Vulnerability (CVE-2016-0705)

Apache HTTP Server Improper Encoding or Escaping of Output Vulnerability (CVE-2024-38473)

WordPress Plugin Badge Designer Lite For WooCommerce includes Backdoor [Only if downloaded via the vendor website] (1.1.0)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update File Inclusion CWE-22 CVE-2014-4940