Vulnerability identifier: #VU19198

Vulnerability risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Hybrid Composer
Server applications / Frameworks for developing and running applications

Vendor: Schiocco

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the function “hc_ajax_save_option” uses "update_option()" along with two parameters that come directly from user input. A remote attacker can gain admin access or inject arbitrary data on the affected system.

This vulnerability leads to Options Update.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Hybrid Composer: 1.4.6

---

External links
http://wpvulndb.com/vulnerabilities/9452/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.