CVE-2014-10021
EXPLOITEDWP Symposium 14.11 - Unauthenticated Arbitrary File Upload via UploadHandler.php
Title source: llmExploitation Summary
CVE-2014-10021 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including Metasploit, Claudio Viviani, Claudio Viviani, rastating, including a Metasploit module exploits/unix/webapp/wp_symposium_shell_upload.
AI-analyzed exploit summary This Metasploit module exploits a file upload vulnerability in WordPress WP Symposium plugin (CVE-2014-10021) to achieve remote code execution by uploading a malicious PHP payload. The exploit leverages improper file sanitization in the file_upload_form.php script.
Description
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/.
Exploits (3)
This Metasploit module exploits a file upload vulnerability in WordPress WP Symposium plugin (CVE-2014-10021) to achieve remote code execution by uploading a malicious PHP payload. The exploit leverages improper file sanitization in the file_upload_form.php script.
This exploit targets a file upload vulnerability in WordPress WP Symposium 14.11, allowing arbitrary file uploads via an unprotected endpoint. It bypasses extension checks by leveraging a vulnerable upload handler.
This Metasploit module exploits a file upload vulnerability in WP Symposium plugin for WordPress, allowing arbitrary PHP code execution by uploading a malicious PHP file and accessing it directly.