CVE-2019-8942

Related Files

WordPress 5.0.0 crop-image Shell Upload

Posted Apr 4, 2019

Authored by RIPSTECH Technology, Wilfried Becard | Site metasploit.com

This Metasploit module exploits a path traversal and a local file inclusion vulnerability on WordPress versions 5.0.0 and versions below or equal to 4.9.8. The crop-image function allows a user, with at least author privileges, to resize an image and perform a path traversal by changing the _wp_attached_file reference during the upload. The second part of the exploit will include this image in the current theme by changing the _wp_page_template attribute when creating a post. This exploit module only works for Unix-based systems currently.

tags | exploit, local, file inclusion

systems | unix

advisories | CVE-2019-8942, CVE-2019-8943

SHA-256 | bd1f2d0a7453946a4baa703e14878a8668792a590d2018556e1e736471a78c41

Download | Favorite | View

Debian Security Advisory 4401-1

Posted Mar 1, 2019

Authored by Debian | Site debian.org

Debian Linux Security Advisory 4401-1 - Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and PHP injections attacks, delete files, leak potentially sensitive data, create posts of unauthorized types, or cause denial-of-service by application crash.

tags | advisory, remote, web, php, vulnerability

systems | linux, debian

advisories | CVE-2018-20147, CVE-2018-20148, CVE-2018-20149, CVE-2018-20150, CVE-2018-20151, CVE-2018-20152, CVE-2018-20153, CVE-2019-8942

SHA-256 | 492fe3e260dc593d29548bd956d9378ccf1ca3fff50153ea674dfbee1da8a7d4

Download | Favorite | View