Description

WordPress Plugin Analytics Stats Counter Statistics is prone to a vulnerability that lets remote attackers inject and execute arbitrary code because the application fails to sanitize user-supplied input before being passed to the unserialize() PHP function. Attackers can possibly exploit this issue to execute arbitrary PHP code within the context of the affected webserver process. WordPress Plugin Analytics Stats Counter Statistics version 1.2.2.5 is vulnerable; prior versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

https://www.pluginvulnerabilities.com/2016/12/15/php-object-injection-vulnerability-in-stats-counter/

https://sumofpwn.nl/advisory/2016/analytics_stats_counter_statistics_wordpress_plugin_unauthenticated_php_object_injection_vulnerability.html

http://www.openwall.com/lists/oss-security/2017/03/01/5

https://packetstormsecurity.com/files/141380/WordPress-Analytics-Stats-Counter-Statistics-1.2.2.5-PHP-Object-Injection.html

Related Vulnerabilities

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2359)

WordPress Plugin HTML5 Video Player with Playlist Multiple Cross-Site Scripting Vulnerabilities (2.40)

WordPress Incorrect Authorization Vulnerability (CVE-2017-6816)

WordPress Plugin Flexible Checkout Fields for WooCommerce Security Bypass (2.3.1)

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-6147)

Severity

High

Classification

CWE-915 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update