Creative Contact Form Plugin up to 1.0.0/2.0.1/6.4.4 on WordPress UploadHandler.php unrestricted upload

Summaryinfo

A vulnerability, which was classified as critical, was found in Creative Contact Form Plugin up to 1.0.0/2.0.1/6.4.4 on WordPress. This issue affects some unknown processing of the file server/php/UploadHandler.php. The manipulation results in unrestricted upload. This vulnerability is identified as CVE-2014-8739. The attack can be executed remotely. Additionally, an exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Creative Contact Form Plugin up to 1.0.0/2.0.1/6.4.4 on WordPress. It has been classified as critical. Affected is some unknown functionality of the file server/php/UploadHandler.php. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.

The advisory is shared for download at exploit-db.com. This vulnerability is traded as CVE-2014-8739 since 11/13/2014. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1608.002.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:server/php/UploadHandler.php it is possible to find vulnerable targets with Google Hacking.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at wordpress.org.

The vulnerability is also documented in the databases at Exploit-DB (35057) and OSVDB (113669†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Creative Contact Form Plugin

Version

• 1.0
• 2.0.0
• 2.0.1
• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion