CVE-2014-8877

2014-12-0518:59:00

CWE-94

[email protected]

web.nvd.nist.gov

cve-2014-8877

wordpress

creativeminds

downloads manager

remote code execution

security vulnerability

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.6 High

AI Score

Confidence

High

0.461 Medium

EPSS

Percentile

97.4%

JSON

The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP create_function function.

Affected configurations

NVD

Node

creative_mindscm_download_managerRange≤2.0.3wordpress

creative_mindscm_download_managerMatch2.0.0wordpress

creative_mindscm_download_managerMatch2.0.1wordpress

creative_mindscm_download_managerMatch2.0.2wordpress

CPENameOperatorVersion
creative_minds:cm_download_managercreative minds cm download managerle2.0.3
creative_minds:cm_download_managercreative minds cm download managereq2.0.0
creative_minds:cm_download_managercreative minds cm download managereq2.0.1
creative_minds:cm_download_managercreative minds cm download managereq2.0.2

CPE	Name	Operator	Version
creative_minds:cm_download_manager	creative minds cm download manager	le	2.0.3
creative_minds:cm_download_manager	creative minds cm download manager	eq	2.0.0
creative_minds:cm_download_manager	creative minds cm download manager	eq	2.0.1
creative_minds:cm_download_manager	creative minds cm download manager	eq	2.0.2