Описание
The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.0 (включая)
cpe:2.3:a:wpsocket:automatic_grid_image_listing:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 75%
0.00907
Низкий
7.2 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-434
Связанные уязвимости
CVSS3: 7.2
github
больше 3 лет назад
The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
EPSS
Процентиль: 75%
0.00907
Низкий
7.2 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-434