Date: Wed, 10 Jun 2015 15:45:37 +0200 From: Sebastian Wolfgang Kraemer | HSASec <Sebastian.Kraemer@...Augsburg.de> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> CC: "Michael.Kapfer@...augsburg.de" <Michael.Kapfer@...augsburg.de> Subject: CVE Request - Arbitrary file upload in Wordpress Plugin: N-Media file uploader v3.7 Greetings, we discovered a vulnerability in the following component and want to request a CVE for it: Product-Type: Wordpress Plugin Product: N-Media file uploader (https://wordpress.org/plugins/nmedia-user-file-uploader/) Version: up to 3.7 Vendor: N-Media (http://najeebmedia.com/) Fixed: fixed in version 3.8 Changelog: Version 3.8 not documented in changelog PoC available: yes Researchers: * Michael Kapfer (https://www.HSASec.de) * Sebastian Kraemer (https://www.HSASec.de) Description: This plugin enables users to upload files to a wordpress-instance and share it with the wordpress-admin. Through insufficient input validation an unauthenticated attacker is able to bypass the restriction and upload arbitrary content. This uploaded content can be executed by calling the url of the file in the public available upload directory. Best regards, the HSASec-Team (https://www.hsasec.de) Download attachment "smime.p7s" of type "application/pkcs7-signature" (5123 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ