CVE-2014-8877

2014-12-0518:59:00

CWE-94

[email protected]

web.nvd.nist.gov

cve-2014-8877

wordpress

creativeminds

downloads manager

remote code execution

security vulnerability

9.6 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.461 Medium

EPSS

Percentile

97.4%

JSON

The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP create_function function.

CPENameOperatorVersion
creative_minds:cm_download_managercreative minds cm download managereq2.0.2
creative_minds:cm_download_managercreative minds cm download managerle2.0.3
creative_minds:cm_download_managercreative minds cm download managereq2.0.1
creative_minds:cm_download_managercreative minds cm download managereq2.0.0

CPE	Name	Operator	Version
creative_minds:cm_download_manager	creative minds cm download manager	eq	2.0.2
creative_minds:cm_download_manager	creative minds cm download manager	le	2.0.3
creative_minds:cm_download_manager	creative minds cm download manager	eq	2.0.1
creative_minds:cm_download_manager	creative minds cm download manager	eq	2.0.0