CVE-2017-1002001

published 2017-09-14

CVE-2017-1002001: Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.

Priority P2 60 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
invedion	mobile-app-builder-by-wappress	>= unspecified < 1.05	1.05
mobile-app-builder-by-wappress_project	mobile-app-builder-by-wappress	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /wp-content/plugins/mobile-app-builder-by-wappress/↗

command ?alien=whoami↗

command ?alien=command↗

• → Detect arbitrary file upload attempts targeting WordPress plugin directories via HTTP POST with multipart file data ↗
• → Monitor for web shell execution via query parameter '?alien=' in GET requests to wp-content/plugins paths, indicating post-exploitation shell interaction ↗
• → Alert on file uploads to /wp-content/plugins/mobile-app-builder-by-wappress/ directory, especially non-image/non-expected file types ↗

• · The vulnerable plugin version is v1.05; installations on this version bundle unlicensed third-party CMS software from invedion.com which contains the exploitable file upload functionality ↗
• · The exploit targets multiple WordPress plugins sharing the same vulnerable bundled CMS component; detections should not be scoped solely to mobile-app-builder-by-wappress ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434