CVE-2014-2996 affects XCloner Standalone 3.5 and earlier, allowing remote authenticated administrators to execute arbitrary commands. This occurs when enable_db_backup and sql_mem are enabled, through shell metacharacters in the dbbackup_comp parameter during a generate action to index2.php. The vulnerability has a CVSS score of 7.1, indicating high severity due to network-based attacks with high impact on confidentiality, integrity, and availability, though it requires high attack complexity and authenticated access. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an ExploitDB entry for a related Cross-Site Request Forgery (CVE-2014-2579) exists, which could potentially be leveraged. Community discussion and media coverage for this specific CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.5CPE matchmatch criteria | cpe:2.3:a:xcloner:xcloner:*:*:standalone:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:H/Au:S/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.