CVE-2024-6451 AI Engine < 2.5.1 - Admin+ RCE

2024-08-1906:00:05

WPScan

github.com

ai engine

remote code execution

log poisoning

vulnerability

AI Score

6.9

Confidence

Low

EPSS

Percentile

9.5%

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of “logs_path”, allowing Administrators to change log filetypes from .log to .php.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "AI Engine",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "2.5.1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ai_engine_project:ai_engine:*:*:*:*:*:*:*:*"
    ],
    "vendor": "ai_engine_project",
    "product": "ai_engine",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.5.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]