CVE-2013-5961 : Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers

Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in lazy-seo/.

Published 2013-09-30 22:55:03

Updated 2017-08-29 01:33:54

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2013-5961

EPSS FAQ

12.65%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-5961

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

References for CVE-2013-5961

http://www.exploit-db.com/exploits/28452

WordPress Plugin Lazy SEO 1.1.9 - Arbitrary File Upload - PHP webapps Exploit
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/87384

Lazy SEO plugin for WordPress lazyseo.php file upload CVE-2013-5961 Vulnerability Report
http://packetstormsecurity.com/files/123349

WordPress Lazy SEO 1.1.9 Shell Upload ≈ Packet Storm
Exploit

Products affected by CVE-2013-5961

Danny Morris » Lazy Seo » Version: 1.1.9
cpe:2.3:a:danny_morris:lazy_seo:1.1.9:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A

Vulnerability Details : CVE-2013-5961

Exploit prediction scoring system (EPSS) score for CVE-2013-5961

CVSS scores for CVE-2013-5961

References for CVE-2013-5961

Products affected by CVE-2013-5961