HIGH🇬🇧 English

CVE-2014-9521

CVSS 7.5v2.0pub. 2015-01-05upd. 2026-05-06

Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the uploads directory, as demonstrated by the .php.swp filename.

oryginał EN
CVSS Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Infinitewp

    APP
    Infinitewp
    ≤ 2.4.3
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCE
CWE
Referencje

Powiązane podatności

CVE-2020-28642CRITICAL9.8ten sam produkt

In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which m...

CVE-2014-9519HIGH7.5ten sam produkt

SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to exe...

CVE-2014-9520HIGH7.5ten sam produkt

SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to e...