Exploitation Summary
EIP tracks 2 public exploits for CVE-2015-10144.
PoCs published by Arash Khazaei, Arash Khazaei, Shelby Pace, including Metasploit module exploits/multi/http/wp_responsive_thumbnail_slider_upload.
AI-analyzed exploit summary This is a writeup describing an arbitrary file upload vulnerability in the WordPress Responsive Thumbnail Slider plugin version 1.0. The exploit involves uploading a file with a double extension and intercepting the request to modify the filename to achieve remote code execution.
Description
The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible.
Exploits (2)
This is a writeup describing an arbitrary file upload vulnerability in the WordPress Responsive Thumbnail Slider plugin version 1.0. The exploit involves uploading a file with a double extension and intercepting the request to modify the filename to achieve remote code execution.
This Metasploit module exploits an arbitrary file upload vulnerability in the WordPress Responsive Thumbnail Slider plugin v1.0, allowing authenticated attackers to upload and execute malicious PHP files. It includes authentication, version checking, and payload delivery mechanisms.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H