Bit Form < 1.9 – RCE via Unauthenticated Arbitrary File Upload | CVE 2022-4774 | Plugin Vulnerabilities

Description

The plugin does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.

Proof of Concept

As an unauthenticated user access a form containing a File Upload form.

Upload a malicious html file (containing a malicious js for example) named after an image file, for example, and intercept the request.

Change the filename's extension in the request to html and forward the request.

The malicious HTML will be available on the uploads directory.

Affects Plugins

Fixed in 1.9

References

CVE

Miscellaneous

Original Researcher

Felipe Restrepo Rodríguez

Submitter

Felipe Restrepo Rodríguez

Submitter website

https://www.pfelilpe.com/

Submitter twitter

Verified

Yes

WPVDB ID

2ae5c375-a6a0-4c0b-a9ef-e4d2a28bce5e

Timeline

Publicly Published

2023-04-19 (about 2 years ago)

Added

2023-04-19 (about 2 years ago)

Last Updated

2023-04-19 (about 2 years ago)

Other

Published

Title

Published

2024-08-05

Title

Blox Page Builder <= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload

Published

2025-05-08

Title

Drag and Drop Multiple File Upload for WooCommerce < 1.1.7 - Unauthenticated Arbitrary File Upload via upload Function

Published

2020-07-16

Title

JetBackup < 1.4.0 - Arbitrary File Upload via CSRF

Published

2022-11-09

Title

wpForo Forum < 2.1.0 - Subscriber+ Arbitrary File Upload

Published

2021-08-23

Title

Simple School Staff Directory <= 1.1 - Admin+ Arbitrary File Upload