CVE-2018-15877

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

76.99%

Published

Aug 26, 2018

Modified

Nov 21, 2024

Public PoC / Exploit (3)

All weaponized →

TrickestTrickest PoC index Exploit-DBWordPress Plugin Plainview Activity Monitor 20161228 - (Authenticated) Command Injection Exploit-DBWordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools request.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

Affected Products (1)

plainview_activity_monitor_project · plainview_activity_monitor (up to 20180826)vulnerable

References (8)

http://packetstormsecurity.com/files/155502/WordPress-Plainview-Activity-Monitor-20161228-Remote-Command-Execution.html

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/163425/WordPress-Plainview-Activity-Monitor-20161228-Remote-Code-Execution.html

ExploitThird Party AdvisoryVDB Entry

https://github.com/aas-n/CVE/tree/master/CVE-2018-15877

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/45274/

Exploit

KEV Catalog EPSS Scores Vendors All CVEs