CVE-2014-8739
CRITICAL EXPLOITED IN THE WILD NUCLEICreative Contact Form < 1.0.0 - Unauthenticated Arbitrary File Upload via jQuery File Upload Plugin
Title source: manualExploitation Summary
CVE-2014-8739 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 3 public exploits from researchers including Metasploit, Claudio Viviani, Gianni Angelozzi, including a Metasploit module exploits/unix/webapp/wp_creativecontactform_file_upload.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary PHP file upload vulnerability in WordPress Creative Contact Form 0.9.7, allowing remote code execution by uploading a malicious PHP payload via a multipart form request.
Description
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
Exploits (3)
This Metasploit module exploits an arbitrary PHP file upload vulnerability in WordPress Creative Contact Form 0.9.7, allowing remote code execution by uploading a malicious PHP payload via a multipart form request.
This exploit targets a file upload vulnerability in WordPress (Sexy Contact Form plugin <= 0.9.7) and Joomla (Creative Contact Form extension <= 2.0.0), allowing arbitrary file uploads leading to remote code execution. It crafts a multipart form request to bypass restrictions and uploads a malicious file.
This Metasploit module exploits an arbitrary file upload vulnerability in WordPress Creative Contact Form 0.9.7, allowing remote code execution via PHP file upload. It uploads a malicious PHP payload and triggers it to achieve RCE.
Nuclei Templates (1)
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H