WordPress Plugin Vulnerabilities
SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload
Description
The plugin allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that on Windows servers, the security checks in place were insufficient, enabling bad actors to potentially upload backdoors on vulnerable sites.
Proof of Concept
1. Create the SP Project & Document Manager page such as 'sp-document' 2. Upload a file and intercept the request. 3. Rename the dlg-upload-file[] parameter from '1.txt' with '1.php.' , it is very important the filename endswith 'php.' .
Affects Plugins
Fixed in 4.24 References
Miscellaneous
Original Researcher
pang0lin @webray.com.cn inc
Submitter
pang0lin @webray.com.cn inc
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-06-28 (about 2 years ago)
Added
2022-03-31 (about 2 years ago)
Last Updated
2022-04-10 (about 2 years ago)
WPScan 