jQuery File Upload Plugin Unrestricted file upload vulnerability
Unrestricted file upload vulnerability in `server/php/UploadHandler.php` in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in `files/`, as exploited in the wild in October 2014.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2014-8739US | critical9.8 | Exploit | ||
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (f… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://osvdb.org/show/osvdb/113669WEB
- http://osvdb.org/show/osvdb/113673WEB
- http://www.openwall.com/lists/oss-security/2014/11/11/4WEB
- http://www.openwall.com/lists/oss-security/2014/11/11/5WEB
- http://www.openwall.com/lists/oss-security/2014/11/13/3WEB
- https://nvd.nist.gov/vuln/detail/CVE-2014-8739ADVISORY
- https://wordpress.org/plugins/sexy-contact-form/changelogWEB
- https://www.exploit-db.com/exploits/35057WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan