Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2011-4899 — Static Code Injection in Wordpress

6 documents5 sources

Severity

7.5HIGHNVD

EPSS

5.7%

top 9.55%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Wordpress Debian Wordpress

Timeline

PublishedJan 30

Latest updateMay 17

Description

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue…

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDwordpress/wordpress3.3.1+72

▶debiandebian/wordpress

🔴Vulnerability Details

GHSA

GHSA-75qw-xjcp-vvmv: ** DISPUTED ** wp-admin/setup-config↗2022-05-17

▶

OSV

CVE-2011-4899: ** DISPUTED ** wp-admin/setup-config↗2012-01-30

▶

OSV

CVE-2011-4899: wp-admin/setup-config↗2012-01-30

▶

💥Exploits & PoCs

Exploit-DB

WordPress Core 3.3.1 - Multiple Vulnerabilities↗2012-01-25

▶

📋Vendor Advisories

Debian

CVE-2011-4899: wordpress - wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and e...↗2011

▶