Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 10 Jun 2015 15:45:37 +0200
From: Sebastian Wolfgang Kraemer | HSASec <Sebastian.Kraemer@...Augsburg.de>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
CC: "Michael.Kapfer@...augsburg.de" <Michael.Kapfer@...augsburg.de>
Subject: CVE Request - Arbitrary file upload in Wordpress Plugin: N-Media
 file uploader v3.7

Greetings,

we discovered a vulnerability in the following component and want to
request a CVE for it:

Product-Type:    
Wordpress Plugin

Product:        
N-Media file uploader
(https://wordpress.org/plugins/nmedia-user-file-uploader/)

Version:        
up to 3.7

Vendor:        
N-Media (http://najeebmedia.com/)

Fixed:            
fixed in version 3.8

Changelog:        
Version 3.8 not documented in changelog

PoC available:    
yes

Researchers:   
* Michael Kapfer (https://www.HSASec.de)
* Sebastian Kraemer (https://www.HSASec.de)

Description:
This plugin enables users to upload files to a wordpress-instance and
share it with the wordpress-admin. Through insufficient input validation
an unauthenticated attacker is able to bypass the restriction and upload
arbitrary content. This uploaded content can be executed by calling the
url of the file in the public available upload directory.


Best regards,
 the HSASec-Team
 (https://www.hsasec.de)
 


[ CONTENT OF TYPE application/pkcs7-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ