CVE-2014-1905: Command Injection
Unrestricted file upload vulnerability in ls/vwsnapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1905?
CVE-2014-1905 is considered a critical vulnerability due to its potential for remote code execution through file upload.
How do I fix CVE-2014-1905?
To fix CVE-2014-1905, update the VideoWhisper Live Streaming Integration plugin to version 4.29.5 or later.
What does CVE-2014-1905 allow an attacker to do?
CVE-2014-1905 allows attackers to upload malicious files and execute arbitrary PHP code on the server.
Which versions of VideoWhisper Live Streaming Integration are affected by CVE-2014-1905?
Versions of VideoWhisper Live Streaming Integration prior to 4.29.5 are vulnerable to CVE-2014-1905.
What is the impact of CVE-2014-1905 on WordPress sites?
The impact of CVE-2014-1905 on WordPress sites includes potential compromise of the server and unauthorized access to sensitive data.