Strategic Overview
- Status
- Patched in 2.72
- Affected Plugin
- WP-DBManager
- Affected Version
< 2.72- CVSS
- 7.8High
- Weakness type
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CVE
CVE-2014-8334
At a glance
CVE-2014-8334 is a high-severity Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the WP-DBManager WordPress plugin, affecting versions < 2.72. It carries a CVSS score of 7.8 (low attack complexity; high confidentiality, integrity, availability impact). The issue is fixed in version 2.72; sites on affected versions should update now. Disclosed October 2014, reported by Larry W. Cashdollar.
Vulnerability Overview
The WP-DBManager (aka Database Manager) plugin before 2.72 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backup['filepath'] (aka "Path to Backup:" field) or (2) $backup['mysqldumppath'] variable.
Technical Analysis
The vector marks this flaw as requiring local or adjacent access, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Remediation
Update to version 2.72, or a newer patched version
How does WordSec protect against this?
The attempt arrives as an ordinary request to WP-DBManager: WordSec's web application firewall inspects request payloads before WordPress loads them. Classes like this one can leave something behind, so the staged malware scanner is the second half: it looks for dropped files and modified code rather than for the request that created them. None of that substitutes for the fix: WP-DBManager 2.72 closes this, and updating the plugin is the step that ends it.
- Firewall
- Scanner
- Alerts
External References
Related records
Same weakness class
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C