WordPress Plugin Vulnerabilities
Awesome Support < 6.1.5 - Submitter+ Arbitrary File Deletion
Description
The plugin does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.
Proof of Concept
1. Visit Tickets > Settings > File Upload 2. Ensure "Enable File Upload", "Enable drag-n-drop uploader for ticket form", and "Check this to allow users to delete attachments" are checked, and save the settings. 3. As a ticket submitter, open the form to submit a ticket. Upload an attachment. 4. Remove the attachment, and intercept the request. Replace the file name with `../../../../wp-config.php`. 5. Reload the page to see that the `wp-config.php` file has been deleted.
Affects Plugins
Fixed in 6.1.5 References
CVE
Classification
Type
ACCESS CONTROLS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Alex Sanford
Submitter
Alex Sanford
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-10-16 (about 1 months ago)
Added
2023-10-16 (about 1 months ago)
Last Updated
2023-10-17 (about 1 months ago)
WPScan 