CVE-2012-10064 Omni Secure Files < 0.1.14 Unauthenticated Arbitrary File Upload
CriticalCVSS 9.3
EPSS 0.74%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plugins/omni-secure-files/plupload/examples/upload.php handler allows unauthenticated uploads without enforcing safe file type restrictions, enabling an attacker to place attacker-controlled files under the plugin's uploads directory. This can lead to remote code execution if a server-executable file type is uploaded and subsequently accessed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Omnilogic Omni Secure Files | < 0.1.14 | 0.1.14 |
| wordpress omni-secure-files(WordPress) | < 0.1.14 | 0.1.14 |
References
- wpscan.com exploit third-party-advisory
- www.wordfence.com patch third-party-advisory
- wordpress.org product
- www.acunetix.com third-party-advisory
- web.archive.org third-party-advisory
- packetstorm.news exploit
- www.exploit-db.com exploit
- web.archive.org third-party-advisory
- www.vulncheck.com third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org