[<prev] [next>] [day] [month] [year] [list]
Message-ID: <55783F81.3080706@HS-Augsburg.de>
Date: Wed, 10 Jun 2015 15:45:37 +0200
From: Sebastian Wolfgang Kraemer | HSASec <Sebastian.Kraemer@...Augsburg.de>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
CC: "Michael.Kapfer@...augsburg.de" <Michael.Kapfer@...augsburg.de>
Subject: CVE Request - Arbitrary file upload in Wordpress Plugin: N-Media
file uploader v3.7
Greetings,
we discovered a vulnerability in the following component and want to
request a CVE for it:
Product-Type:
Wordpress Plugin
Product:
N-Media file uploader
(https://wordpress.org/plugins/nmedia-user-file-uploader/)
Version:
up to 3.7
Vendor:
N-Media (http://najeebmedia.com/)
Fixed:
fixed in version 3.8
Changelog:
Version 3.8 not documented in changelog
PoC available:
yes
Researchers:
* Michael Kapfer (https://www.HSASec.de)
* Sebastian Kraemer (https://www.HSASec.de)
Description:
This plugin enables users to upload files to a wordpress-instance and
share it with the wordpress-admin. Through insufficient input validation
an unauthenticated attacker is able to bypass the restriction and upload
arbitrary content. This uploaded content can be executed by calling the
url of the file in the public available upload directory.
Best regards,
the HSASec-Team
(https://www.hsasec.de)
Download attachment "smime.p7s" of type "application/pkcs7-signature" (5123 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
