CVE-2017-1002002

published 2017-09-14

CVE-2017-1002002: Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/

Priority P2 61 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/

Affected

2 ranges

Vendor	Product	Version range	Fixed in
invedion	webapp-builder	>= unspecified < 2.0	2.0
webapp-builder_project	webapp-builder	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /wp-content/plugins/webapp-builder/↗

command ?alien=whoami↗

other ?alien=command↗

• → Detect arbitrary file upload attempts targeting WordPress plugin directories via HTTP POST with multipart file data ↗
• → Monitor for web shell command execution via the '?alien=' query parameter pattern in HTTP GET requests to wp-content/plugins paths ↗
• → Alert on file uploads to /wp-content/plugins/webapp-builder/ directory, especially executable script files (webshells) ↗

• · The exploit targets multiple WordPress plugins beyond webapp-builder v2.0; the plugin name is passed as a variable, so detections should not be scoped solely to webapp-builder ↗
• · The web shell query parameter used for command execution is '?alien=', which is specific to this exploit's shell; defenders should tune for this parameter pattern ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434