CVE-2014-8739
CRITICAL EXPLOITED IN THE WILD NUCLEIjQuery File Upload Plugin <6.4.4 - RCE
Title source: llmDescription
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
Exploits (4)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/36811
exploitdb
WORKING POC
by Claudio Viviani · pythonwebappsphp
https://www.exploit-db.com/exploits/35057
metasploit
WORKING POC
EXCELLENT
by Gianni Angelozzi · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_creativecontactform_file_upload.rb
Nuclei Templates (1)
WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload
CRITICALVERIFIEDby melmathari
References (8)
Scores
CVSS v3
9.8
EPSS
0.9155
EPSS Percentile
99.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2020-02-08
InTheWild.io
2020-02-12
CWE
CWE-434
Status
published
Products (4)
blueimp/jquery-file-upload
Packagist
creative-solutions/creative_contact_form
< 1.0.0
creative-solutions/creative_contact_form
< 2.0.1
jquery_file_upload_project/jquery_file_upload
6.4.4
Published
Feb 08, 2020
Tracked Since
Feb 18, 2026