CVE-2014-6446
Infusionsoft Gravity Forms 1.5.3-1.5.10 - Unauthenticated Arbitrary File Upload and Remote Code Execution
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-6446.
PoCs published by Metasploit, g0blin, us3r777 <[email protected]>, including Metasploit module exploits/unix/webapp/wp_infusionsoft_upload.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary PHP code upload vulnerability in the WordPress InfusionSoft Gravity Forms plugin (versions 1.5.3 to 1.5.10). It uploads a malicious PHP file via the 'code_generator.php' endpoint and executes it to achieve remote code execution.
Description
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
Exploits (2)
This Metasploit module exploits an arbitrary PHP code upload vulnerability in the WordPress InfusionSoft Gravity Forms plugin (versions 1.5.3 to 1.5.10). It uploads a malicious PHP file via the 'code_generator.php' endpoint and executes it to achieve remote code execution.
This Metasploit module exploits an arbitrary PHP code upload vulnerability in the WordPress Infusionsoft Gravity Forms plugin (versions 1.5.3 to 1.5.10). It uploads a malicious PHP file via the 'code_generator.php' endpoint and triggers execution by accessing the uploaded file.