CVE-2013-5963 Simple Dropbox Upload < 1.8.8.1 - Arbitrary File Upload
MediumCVSS 6.8
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/wpdb/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cdsincdesign simple dropbox upload form | <= 1.8.8 | No fix listed |
| cdsincdesign simple dropbox upload form | = 0.5.0 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.0.0 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.1.0 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.1.1 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.1.2 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.2.0 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.3.0 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.3.1 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.4.0 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.5.0 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.5.1 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.5.2 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.5.3 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.6.0 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.7.0 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.8.0 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.8.1 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.8.2 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.8.3 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.8.4 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.8.5 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.8.6 | No fix listed |
| cdsincdesign simple dropbox upload form | = 1.8.7 | No fix listed |
| wordpress simple-dropbox-upload-form(WordPress) | < 1.8.8.1 | 1.8.8.1 |
References
- packetstormsecurity.com exploit
- plugins.trac.wordpress.org
- 54856 third-party-advisory vendor-advisory
- wordpress.org exploit patch
- simpledropboxupload-multi-file-upload(87166) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org