CVE-2015-2825

High

Published: 21/04/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

A vulnerability in the Simple Ads Manager plugin before version 2.5.96 for WordPress allows remote attackers to upload files with executable extensions, leading to arbitrary code execution.

Risk Assessment

Attackers can exploit this vulnerability to remotely execute code on the server, potentially leading to system takeover or data leakage.

Recommendation

It is recommended to update the Simple Ads Manager plugin to the latest version and implement mechanisms to restrict file uploads to allowed types.

Other vulnerabilities in Simple Ads Manager plugin for WordPress

CVE-2015-2824High
The Simple Ads Manager plugin before version 2.7.97 for WordPress contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands.

Original NVD description (English source)

Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the path parameter.