CVE-2009-2852: Input Validation
Published Aug 18, 2009
·Updated
WP-Syntax plugin 0.9.1 and earlier for Wordpress, with registerglobals enabled, allows remote attackers to execute arbitrary PHP code via the testfilter[wphead] array parameter to test/index.php, which is used in a call to the calluserfuncarray function.
Affected Software
2 affected components
Ryan.mcgeary Wp-syntax<=0.9.1
WordPress WordPress
Event History
Aug 18, 2009
CVE Published
via MITRE·08:41 PM
Data Sourced
via MITRE·08:41 PM
Description
Data Sourced
09:00 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-2852?
CVE-2009-2852 is considered to have a high severity due to its potential for remote code execution.
2
How do I fix CVE-2009-2852?
To fix CVE-2009-2852, upgrade the WP-Syntax plugin to version 0.9.2 or later.
3
Which versions of the WP-Syntax plugin are affected by CVE-2009-2852?
WP-Syntax versions 0.9.1 and earlier are affected by CVE-2009-2852.
4
Can CVE-2009-2852 be exploited without authentication?
Yes, CVE-2009-2852 can be exploited by remote attackers without requiring authentication.
5
What specific WordPress configurations are vulnerable to CVE-2009-2852?
CVE-2009-2852 is particularly vulnerable when the register_globals feature is enabled in PHP.