CVE-2012-5318 Kish Guest Posting <= 1.2 - Unauthenticated Arbitrary File Upload
MediumCVSS 6.8
EPSS 6.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the directory specified by the folder parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1125.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kishore asokan kish guest posting plugin | = 1.2 | No fix listed |
| wordpress kish-guest-posting(WordPress) | <= 1.2 | No fix listed |
References
- 47688 third-party-advisory vendor-advisory
- [oss-security] 20120308 Re: CVE-request: Kish Guest Posting Plugin for WordPress File Upload Remote PHP Code Execution mailing-list
- Wordfence Intelligence third-party-advisory
- www.cve.org