webence iq_block_country 文件名或路径的外部可控制

CVE编号

CVE-2022-0246

利用情况

暂无

补丁情况

N/A

披露时间

2022-04-11

漏洞描述

The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	webence	iq_block_country	*		Up to (excluding) 1.2.13

CVSS3评分 4.9

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 高
• 影响范围 未更改
• 用户交互 无
• 可用性 无
• 保密性 无
• 完整性 高

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N CWE-ID 漏洞类型 CWE-73 文件名或路径的外部可控制