CVE-2018-9206

Related Files

Blueimp jQuery File Upload 9.22.0 Arbitrary File Upload

Posted Jan 17, 2019

Authored by Larry W. Cashdollar

Blueimp jQuery File Upload versions 9.22.0 and below suffer from a remote file upload vulnerability.

tags | exploit, remote, file upload

advisories | CVE-2018-9206

SHA-256 | e9f157afd7f59180b86e0627f3b9de79d4da7a9d147657e0cbddcbeeed0173eb

Download | Favorite | View

blueimp jQuery Arbitrary File Upload

Posted Nov 5, 2018

Authored by Larry W. Cashdollar, wvu, Claudio Viviani | Site metasploit.com

This Metasploit module exploits an arbitrary file upload in the sample PHP upload handler for blueimp's jQuery File Upload widget in versions 9.22.0 and below. Due to a default configuration in Apache 2.3.9+, the widget's .htaccess file may be disabled, enabling exploitation of this vulnerability. This vulnerability has been exploited in the wild since at least 2015 and was publicly disclosed to the vendor in 2018. It has been present since the .htaccess change in Apache 2.3.9. This Metasploit module provides a generic exploit against the jQuery widget.

tags | exploit, arbitrary, php, file upload

advisories | CVE-2018-9206

SHA-256 | d34fb14aa9b4338617c18788b969d61c2e2bb73edfa259074f37f0336142d5c4

Download | Favorite | View